In which stage of incident is the environment returned to a secure state?

• 200-201 : All Parts

Returning the environment to a secure state occurs during the remediation stage. There are six steps in the incident:

– Identification – determining whether there is an incident
– Scoping – determining the extent of the incident and identifying the attackers
– Containment – halting the spread of the incident and minimizing the impact
– Remediation – returning the environment to secure state
– Lesson-based hardening preventing future incidents
– Reporting – documenting the incident and reporting it