A school district organizes SOAR folders by NIST-style IR phases to teach new analysts the response model. What training practice is that?

A school district that organizes SOAR folders by NIST-style IR phases to teach new analysts the response model is teaching IR models by aligning civic SOAR folder structure to NIST-style response phases. Folder taxonomy becomes a living classroom map: preparation, detection and analysis, containment/eradication/recovery, and post-incident activity (or the district’s chosen NIST-aligned labels) show newcomers where each playbook belongs in the response journey. That structure reduces onboarding time and keeps automation discoverable under a shared municipal IR vocabulary instead of tribal naming.

Why the other options fail by concept: Hiding all playbooks in one unsorted dump so newcomers invent their own model forces every hire to reverse-engineer process and guarantees inconsistent response. Naming folders after cafeteria menu days instead of IR phases substitutes humor for pedagogy and breaks any mapping to audit or tabletop language. Removing phase labels because automation makes models obsolete confuses tooling with doctrine—automation executes steps; models still explain why and when.

Exam caveat: folder labels should match the district’s adopted IR documentation so tabletop, audit, and SOAR language stay consistent; do not invent a third parallel taxonomy. Operational check: walk a new analyst through the SOAR tree against the written IR plan, confirm each major playbook sits under the correct NIST-style phase folder, and fix orphans before the next onboarding cohort.