A mid-size clinic group's ransomware alert arrived at 2:14 on a Saturday morning, but its response had started six months earlier, in a conference room, with a facilitator reading a made-up attack aloud. That rehearsal exposed gaps the clinic closed before the real attack, and each fix saved time when it mattered. Preparation is the phase nobody sees during an incident, and it decides how every other phase goes.
On the CompTIA Security+ SY0-801 exam, incident response sits under objective 4.7, which expects you to explain each phase of the response process and what happens in it. This lesson covers the phase order the exam uses, then preparation in detail: roles, playbooks, training, testing, tabletop exercises and simulations. The same clinic incident runs through all five lessons in this section, so you can follow each phase as it hands off to the next.
Incident response runs in a set order of eight phases
SY0-801 describes incident response as eight phases. Learn them in this order, because exam questions often ask what a team should do FIRST or NEXT, and the answer is usually the earliest phase whose work isn't finished.
| Phase | The question it answers | In the clinic incident |
|---|---|---|
| Preparation | Are we ready before anything happens? | Plan, roles, playbooks and a tabletop six months earlier |
| Identification | Is this an incident, and how serious is it? | An EDR alert at 02:14 confirmed as ransomware |
| Investigation | How did it happen, and how far did it reach? | Forensics on memory and logs, evidence preserved |
| Containment | How do we stop it spreading? | Hosts isolated, accounts disabled, VPN shut off |
| Negotiation | How do we handle the extortion demand? | Counsel, insurer, negotiator and the FBI involved |
| Eradication and recovery | How do we remove the attacker and restore service? | Rebuilds, password resets, restores from backup |
| Notification and external reporting | Who must be told, and by when? | Patients, regulators, the FBI and the board |
| Post-incident | What do we change so it doesn't happen again? | Lessons learned, root cause analysis, a written report |
Real incidents don't move through the phases one at a time. The clinic called its cyber insurer within hours, long before the notification phase, and investigators kept working through containment and recovery. The sequence describes where each phase's main work sits and what has to be true before the next phase can finish. You can't eradicate an attacker you haven't contained, and a lessons-learned meeting held before recovery is over has nothing complete to review.
Other frameworks group the same work differently. NIST's incident handling guide, SP 800-61, long used four phases, combining detection with analysis and treating containment, eradication and recovery as one phase, and its 2025 revision maps response activities onto the Cybersecurity Framework's functions instead. Those models are sound, but the exam tests its own eight-phase order, so answer from that.
Preparation builds the plan, the contacts and the tools before you need them
Preparation is everything an organization does before an incident so it can respond quickly and correctly. The core document is the incident response plan. It defines what counts as an incident, how severity is rated, who is on the team, who may make which decisions, and how the team communicates. Behind the plan sit the practical pieces that make it usable at 2 a.m.:
- A current contact list: team members and their backups, executives, outside counsel, the cyber insurer's claims hotline, the managed security provider, the forensics firm and law enforcement contacts.
- An out-of-band communication channel, such as a phone bridge or a separate messaging service, because email and chat may be compromised or down.
- A responder toolkit, often called a jump bag: a laptop with forensic tools, clean USB media, write blockers, external drives, evidence bags and chain-of-custody forms.
- Logging and retention set up in advance, since investigators can only analyze logs that were collected and kept.
- Retainers and agreements signed ahead of time, because contracting a forensics firm in the middle of an incident costs hours.
At the clinic, the plan was twelve pages long, owned by the IT security manager, Dana Reyes, and reviewed every year. The clinic used a managed security service provider (MSSP) to watch its EDR and SIEM alerts overnight, and its cyber insurance policy came with a panel of pre-approved forensics firms and breach lawyers. None of that helps unless people know it exists and can use it, which is what the rest of preparation is for.