A CISO asks the IR team to ensure they have documented runbooks for the organization's top five likely incident scenarios. Which PICERL phase does creating these runbooks belong to?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — c is correct because the Preparation phase includes creating and maintaining incident response plans, runbooks, playbooks, and communication templates before any incident occurs, ensuring the team can respond effectively when an incident happens. A is wrong because Identification is the phase where the team detects and confirms that an incident is occurring, not where documentation is pre-created.
Full explanation below image
Full Explanation
C is correct because the Preparation phase includes creating and maintaining incident response plans, runbooks, playbooks, and communication templates before any incident occurs, ensuring the team can respond effectively when an incident happens. A is wrong because Identification is the phase where the team detects and confirms that an incident is occurring, not where documentation is pre-created. B is wrong because Containment is the active response to stop damage during a live incident. D is wrong because Lessons Learned occurs after an incident to improve future response, not to create initial runbooks.