| 3. Incident Response Phases |
| 3.6. Post-Incident Activity |
 | 3.6.1. Create a follow-up report |
| 3.6.2. Hold a lessons learned meeting |
| 3.1. Preparation |
| 3.2. Detection and Analysis |
| 3.3. Containment |
| 3.4. Eradication |
| 3.5. Recovery |
| 3. Incident Response Phases |
| 3.6. Post-Incident Activity |
| 3.6.1. Create a follow-up report |
| 3.6.2. Hold a lessons learned meeting |
| 3.1. Preparation |
| 3.2. Detection and Analysis |
| 3.3. Containment |
| 3.4. Eradication |
| 3.5. Recovery |