Running the response loop
Put the same question to every new fact: does this change scope, containment, eradication or recovery? If it does, the team is on another pass. Say so on the bridge, because silence reads as progress and stakeholders start planning the all-clear.
A straight line through contain, eradicate and recover misses whatever only becomes visible once the evidence has been read. That is the difference the two figures are drawing.
| Trigger | Looks like | Next move |
|---|---|---|
| New indicators | A PowerShell script in a registry key, traffic to unknown C2 | Back to scoping with the new indicator |
| Scope expansion | A known compromised service account also active in a regulated system | Another scoping pass, with new stakeholders and new obligations |
| Incomplete eradication | A system that looked clean shows reinfection | Hunt the missed persistence or the unidentified access vector |
| Analysis revelations | Memory forensics finds a second malware family | Rescope, then revisit containment and eradication |
| Business change | A new obligation or a shift in priorities | Re-triage and reset the plan with decision makers |
Before exiting
| # | Item |
|---|---|
| 1 | Scoping produces no new indicators |
| 2 | Monitoring shows no attacker activity |
| 3 | Eradication verification confirms removal |
| 4 | Restored systems operate normally |
| 5 | Operational objectives met and residual risk acceptable |
| 6 | Cost and benefit no longer favor active response |
| 7 | Regulatory conditions for closure satisfied |
| 8 | Ongoing monitoring decided and assigned an owner |
| 9 | Technical closure signed and residual risk accepted, both with names and times |
Watch out
- Rotate people and schedule rest. Fatigue accumulates across iterations and rarely appears in any report.
- Documentation has to survive shift handover, or incoming analysts repeat work or skip it.
- Name the person who authorizes the exit. An attributed written decision holds up if the incident is reopened or reviewed, and people commit more carefully when their name is on it.