Which of the following is a phase of Incident Management?

• A. Recovery
• B. Containment
• C. Stability
• D. Evaluation

Answer: (A)

Recovery is the phase in the incident management lifecycle where normal operations are restored after the incident has been contained and eradicated. This stage focuses on getting affected systems back online, restoring data from trusted backups or validated sources, reapplying secure configurations, and verifying that services function correctly. It also involves monitoring for any signs of lingering issues or reoccurrence and implementing improvements to prevent a similar incident in the future. Containment, by contrast, is about stopping the incident from spreading while it’s ongoing, not completing the return to full operation. Stability isn’t a standard named phase in many incident management models, and Evaluation (often a post-incident review) typically occurs after recovery to learn from the event. Recovery best fits the role of returning the organization to normal, making it the appropriate choice.