What are the main components of a cyber incident playbook?

What are the main components of a cyber incident playbook?

• A. Detection/triage, containment, eradication, recovery, evidence collection, communication, and post-incident lessons learned.
• B. Asset inventory, licensing, procurement, deployment.
• C. Budget planning, vendor management, marketing.
• D. Incident playbooks are not used in cyberspace operations.

Answer: (A)

A cyber incident playbook guides the response through the full incident lifecycle with a structured, repeatable set of actions. The main components cover detection and triage to quickly identify and classify the incident, containment to stop the spread and limit impact, eradication to remove the threat and any attacker footholds, and recovery to restore normal operations and validate systems. Evidence collection is included to preserve forensics and ensure proper chain of custody for potential investigations. Communication coordinates actions and information flow with internal teams and external parties as needed, and post-incident lessons learned feed improvements into defenses and updates to the playbook itself. This combination ensures a disciplined, timely, and auditable response rather than ad hoc efforts. The other options describe asset management or business operations, which aren’t part of incident response, and the idea that playbooks aren’t used in cyberspace operations is incorrect.

A cyber incident playbook guides the response through the full incident lifecycle with a structured, repeatable set of actions. The main components cover detection and triage to quickly identify and classify the incident, containment to stop the spread and limit impact, eradication to remove the threat and any attacker footholds, and recovery to restore normal operations and validate systems. Evidence collection is included to preserve forensics and ensure proper chain of custody for potential investigations. Communication coordinates actions and information flow with internal teams and external parties as needed, and post-incident lessons learned feed improvements into defenses and updates to the playbook itself. This combination ensures a disciplined, timely, and auditable response rather than ad hoc efforts. The other options describe asset management or business operations, which aren’t part of incident response, and the idea that playbooks aren’t used in cyberspace operations is incorrect.