- Validate the alert and severity.
- Identify affected entities.
- Build a timeline.
- Establish blast radius.
- Contain active risk.
- Remediate root cause.
- Validate recovery and document lessons learned.
CHECKLIST
SC-200 Incident Investigation Checklist
Free CogniSkill Checklist for certification preparation.