thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

SANS PICERL

The SANS six-step incident response model: Preparation, Identification, Containment, Eradication, Recovery and Lessons Learned.

Definition

PICERL separates containment, eradication and recovery into distinct phases, compared with NIST SP 800-61 Rev. 2's combined phase. It is widely used in GIAC certifications and practitioner training.

Example

After identification of a compromised web server, the team moves to containment by blocking its outbound traffic.

Exam tip

SANS uses "Identification" where NIST uses "Detection and Analysis".

Related terms