This lesson develops practical capability in Exploring Response, Containment, Eradication, Recovery, and Coordination within ISO/IEC 27035 Introduction Training. Activities reflect a security team coordinating users, technical responders, business owners, legal counsel, communications, and external providers, so principles, requirements, decisions, evidence, and improvement actions remain connected.
The lesson supports the wider objective to understand information security incident management preparation, detection, assessment, response, recovery, and improvement.
The instructor demonstrates the exploring response, containment, eradication, recovery, and coordination workflow, identifies applicable responsibilities, records checkpoints in incident response and recovery runbook, and contrasts the accepted state with a condition where systems return to service before the intrusion path is removed.
Complete a controlled implementation, management, audit, assessment, foundation, introduction, awareness, or transition exercise for Exploring Response, Containment, Eradication, Recovery, and Coordination. Establish scope and criteria, collect or create evidence, examine “systems return to service before the intrusion path is removed,” reach a supported conclusion, and preserve the result in incident response and recovery runbook.
Separate missing evidence from ineffective practice, and distinguish a documentation issue from a control, process, governance, or competence failure. Use incident response and recovery runbook to trace the earliest divergence. Treat “systems return to service before the intrusion path is removed” as a hypothesis until the response is validated against the applicable requirement and intended outcome.
Learners can apply Exploring Response, Containment, Eradication, Recovery, and Coordination, explain the reasoning used, and defend the result through incident response and recovery runbook.