thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Foundational

Preparation

The incident response phase in which an organization establishes capabilities, tools, plans and training before incidents occur.

Definition

Preparation includes building the IR plan and team, acquiring tools and jump kits, configuring logging, hardening systems, establishing communication channels and running exercises. It is the most important phase because it determines how effective all later phases will be.

Example

Pre-staging forensic tools and creating an out-of-band communication channel for the IR team.

Exam tip

Activities like training and creating playbooks belong to preparation.

Related terms