A CISO asks the IR team to ensure they have documented runbooks for the organization's top five likely incident scenarios. Which PICERL phase does creating these runbooks belong to?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — Preparation is right because you create and maintain runbooks, playbooks, and response plans before an incident happens. That way, your team can act fast and consistently when a likely scenario occurs.
Full Explanation
The Preparation phase is correct because it includes creating and maintaining incident response plans, runbooks, playbooks, and communication templates before any incident occurs, ensuring the team can respond effectively when an incident happens. Identification is wrong because that phase is where the team detects and confirms that an incident is occurring, not where documentation is pre-created. Containment is wrong because it is the active response used to stop damage during a live incident. Lessons Learned is wrong because it occurs after an incident to improve future response, not to create initial runbooks.