The Chief Technical Officer (CTO) has tasked The Computer Emergency Response Team (CERT) to develop
and update all Internal Operating Procedures and Standard Operating Procedures documentation in order to
successfully respond to future incidents. Which of the following stages of the Incident Handling process is the
team working on?

A.
Lessons Learned

B.
Eradication

C.
Recovery

D.
Preparation

Explanation:
Incident response procedures involve: Preparation; Incident identification; Escalation and notification; Mitigation
steps; Lessons learned; Reporting; Recover/reconstitution procedures; First responder; Incident isolation
(Quarantine; Device removal); Data breach; Damage and loss control. Developing and updating all internal
operating and standard operating procedures documentation to handle future incidents is preparation.