Which phase of the incident response lifecycle focuses on establishing the IR team, playbooks, and resources?

• A. Preparation
• B. Identification
• C. Containment
• D. Eradication

Answer: (A)

The phase that focuses on establishing the IR team, playbooks, and resources is about getting ready before anything happens. In this preparation stage you form the incident response team, assign roles and responsibilities, and set up governance, policies, and communication plans. You create and maintain incident response playbooks and runbooks that outline who does what for different incident scenarios, and you ensure the necessary tools, contact lists, and training are in place. This groundwork ensures that when an incident is detected, responders know exactly who to call, what steps to take, and what resources are available, making the response faster and more coordinated.

The other phases address what happens after an incident is detected: recognizing that an incident is occurring, taking steps to limit its spread, and removing the threat from the environment. Without the preparation work, identification, containment, and eradication actions can be chaotic and uncoordinated.