A city maps each SOAR action to PICERL phases so gaps in automated IR support are visible. What practice does that mapping establish?

A city that maps each SOAR action to PICERL phases so gaps in automated IR support are visible is aligning automation coverage to incident response model phases for municipal IR. PICERL (Preparation, Identification, Containment, Eradication, Recovery, Lessons learned) gives a shared civic vocabulary; pinning playbook steps to phases shows which stretches of the response bus route have automation and which still depend entirely on humans. Leadership can then invest in missing phase coverage—such as automated evidence collection in Identification or checklist-driven Lessons learned—instead of stacking redundant steps in a single popular phase.

Why the other options fail by concept: Tuning SOAR detection rules in the identification phase to reduce municipal alerts addresses only one phase and does not establish automation coverage mapping across PICERL. Standardizing containment approvals across municipal teams for faster SOAR execution improves one handoff but does not reveal which phases lack automated support. Documenting SOAR playbook outcomes for lessons-learned review in municipal IR captures phase output, but it does not itself map automation coverage to PICERL phases or expose gaps in municipal IR.

Exam caveat: phase mapping is a coverage and sequencing aid; real incidents can iterate phases, so automation should allow re-entry rather than assuming a single linear pass. Operational check: inventory SOAR actions against PICERL, highlight empty or thin phases for city IR, and schedule playbook work to close the largest municipal gaps before claiming end-to-end automation.