In the Six-Step Preparation phase, what is the primary emphasis?

In the Six-Step Preparation phase, what is the primary emphasis?

• A. Restoring normal business operations
• B. Performing forensic analysis
• C. Establishing a response capability and ensuring that systems, networks, and applications are secure
• D. Rebuilding compromised systems

Answer: (C)

Preparation is about readiness: establishing a formal incident response capability and ensuring that the environment is secured so incidents can be detected, contained, and managed quickly. This means setting up the IR plan, defining roles and responsibilities, creating runbooks and playbooks, training the team, and implementing appropriate defenses, monitoring, and secure baselines across systems, networks, and applications. When a security event occurs, these elements let the organization respond in a repeatable, organized way rather than scrambling reactively. Restoring normal business operations is something that happens after containment and eradication, as part of recovery. Forensic analysis is typically conducted during the investigation/analysis phase to determine the scope and root cause. Rebuilding compromised systems occurs during recovery and remediation, not during the preparation phase.

Preparation is about readiness: establishing a formal incident response capability and ensuring that the environment is secured so incidents can be detected, contained, and managed quickly. This means setting up the IR plan, defining roles and responsibilities, creating runbooks and playbooks, training the team, and implementing appropriate defenses, monitoring, and secure baselines across systems, networks, and applications. When a security event occurs, these elements let the organization respond in a repeatable, organized way rather than scrambling reactively.

Restoring normal business operations is something that happens after containment and eradication, as part of recovery. Forensic analysis is typically conducted during the investigation/analysis phase to determine the scope and root cause. Rebuilding compromised systems occurs during recovery and remediation, not during the preparation phase.