Which of the following is NOT a stage in the incident response lifecycle?

• A. Preparation
• B. Detection and Analysis
• C. Notification and Escalation
• D. Containment

Answer: (C)

Understanding the incident response process means recognizing the distinct actions teams take to handle and learn from security events. The stages typically include preparation (building readiness), detection and analysis (spotting and understanding the incident), containment (stopping further damage), eradication and recovery (removing the threat and restoring systems), and post-incident activity or lessons learned (reviewing what happened to improve defenses).

Notification and escalation, while important for communicating and making timely decisions, isn’t treated as its own separate stage in the standard lifecycle. It’s a flow of governance and communication that happens as needed within the various stages—leaders are notified and higher-level escalation occurs when incidents are severe enough—rather than a standalone phase with its own defined set of incident-handling steps. That’s why the option describing notification and escalation isn’t considered a formal stage in the lifecycle.