anchor@anchor-cyber:~$ man incident-response
Anchor Cyber Security LLC
Incident Response — PICERL
SANS's operational IR model. Six phases, each with a different job and a different way to fail — the split between Containment and Eradication is the one people collapse most often, and it's the one that costs the most when they do.
CSF's RESPOND/RECOVER Functions tell you what outcomes matter. PICERL is the order of operations during an actual incident — use this card mid-incident, use the CSF Field Reference for the audit/gap-analysis side of the same work.
1Preparation— before anything happens
DoIR plan with named owner and authority (RS.MA-01), tested contact list, backups verified restorable, logging actually retained somewhere an attacker can't delete it.
PitfallA written plan nobody has ever run through once. An untested plan is a document, not a capability.
2Identification— is this actually an incident
DoConfirm scope and severity before declaring — what systems, what data, how did you find out.
PitfallTreating every alert as an incident, or the opposite — normalizing real signal as noise until it's too late.
3Containment— stop it from getting worse, right now
DoShort-term: isolate the affected system. Long-term: patch the immediate hole without destroying evidence.
PitfallJumping straight to Eradication before containment is actually stable — the attacker still has a foothold while you're busy cleaning up.
4Eradication— remove the actual cause, not just the symptom
DoRemove malware/access, close the root-cause vulnerability, confirm nothing persistent survived (scheduled tasks, new accounts, backdoors).
PitfallRushing to Recovery because containment "felt" successful — comprehensive eradication checks get skipped under time pressure.
5Recovery— back to normal, deliberately
DoRestore from a verified-clean backup, monitor closely post-restore, confirm the fix holds under real load.
PitfallRestoring from a backup that was never integrity-checked, or that predates when the attacker got in.
6Lessons Learned— feeds back into Preparation
DoAfter-action report: what happened, what worked, what didn't, what changes as a result. This is the step that makes PICERL a loop, not a checklist.
PitfallSkipping this once the fire's out — it's the only phase with no urgency attached, which is exactly why it's the one that gets dropped.
$ ir --who-to-call
Fill in before an incident, not during one.
| Role | Name / contact |
|---|---|
| Incident commander | |
| Technical lead | |
| Legal counsel | |
| Cyber insurance carrier / broker | |
| Outside forensics (on retainer if possible) | |
| Law enforcement (local + FBI IC3) | |
| Client / regulator notification owner |