• Detection and analysis
- IoC
- Evidence acquisitions
o Chain of custody
o Validating data integrity
o Preservation
o Legal hold - Data and log analysis
• Containment, eradication,
and recovery - Scope
- Impact
- Isolation
- Remediation
- Re-imaging
- Compensating controls