IDENTIFICATION
Detect the incident, determine its scope, and involve appropriate parties.
CONTAINMENT
Mitigate the attack’s effects on the environment.
REMEDIATION
Take actions to remove the threat and avoid future incidents.
RECOVERY
Restore the system to normal operations.