Week 16: Incidents Require Decisions Under Uncertainty

An incident-response team rarely starts with complete information. It receives alerts, user reports, system failures, logs, and partial evidence while the system may still be changing.

This week focuses on defensive decision-making: triage, evidence preservation, containment tradeoffs, communication, recovery criteria, post-incident learning, and governance. No live attack procedures are required.

This week

1. Triage Separates Facts, Hypotheses, and Urgency — build an incident statement from incomplete evidence.
2. Containment Is a Business and Systems Decision — compare isolate, disable, monitor, or continue-with-controls options while preserving required function.
3. Recovery Ends With Learning, Not Just Uptime — define recovery evidence, postmortem, corrective actions, owners, and risk-register updates.

Evidence artifact

Create an Incident Decision and Recovery Record containing initial facts, hypotheses, evidence preservation, containment decision, stakeholder communication, recovery criteria, retests, root/contributing causes, and corrective-action ownership.