Incident Eradication, Recovery, and Review is the structured three-phase process that follows incident containment in the ISACA CISM Incident Management lifecycle. Eradication is the verified removal of all root causes, attacker footholds, malicious artifacts, and exploited vulnerabilities — not merely symptoms — from every affected system. Recovery restores affected systems and services to a validated, secure operational state using verified clean sources (integrity-confirmed backups, hardened images). Post-Incident Review is the structured organizational debrief that produces a formal record of timeline, root cause analysis, contributing factors, and accountable remediation actions to prevent recurrence. Together, the three phases close the incident lifecycle and drive continuous improvement of the security program.
Where it stops · what it isn't
- —IS: Verified removal of root causes — exploited vulnerabilities, attacker-created accounts, backdoors, malware — with documented sign-off. Not simply stopping visible symptoms or isolating affected systems.
- —IS: Restoring systems from verified clean backups or hardened images with functional validation before returning to production. Not merely rebooting or restarting compromised systems.
- —IS: A formal structured review meeting with documented root cause analysis, contributing factors, recommendations, assigned owners, and deadlines. Not an informal debrief or verbal conversation.
- —IS NOT: Containment — isolating systems to stop damage is the preceding phase (Incident Investigation, Evaluation, Containment, and Communication) and must be complete before eradication begins.
- —IS NOT: Proactive threat hunting or vulnerability scanning unrelated to an active or recently closed incident. This competency is reactive and incident-triggered.
- —IS NOT: Disaster Recovery (DR) planning or Business Continuity Planning (BCP). Those are separate disciplines; this cubelet addresses incident-specific recovery validation, not broad DR strategy.
- —IS NOT: Deep forensic investigation methodology. Evidence preservation is required, but forensic analysis is a specialized discipline requiring legal counsel coordination.
- —TERMINOLOGY NOTE: ISACA CISM distinguishes 'Eradication' and 'Recovery' as separate, sequential phases. Some frameworks (NIST SP 800-61, SANS) use 'Recovery' to encompass both. Use CISM terminology within this domain.
Connected concepts in the graph
Every cubelet sits in a knowledge graph. Here's what this one connects to.
REQUIRESIncident Investigation, Evaluation, Containment, and CommunicationEvidence Preservation and Chain of Custody
PART OFCISM Domain 4: Incident Management
ENABLESSecurity Program Continuous ImprovementRegulatory Compliance Demonstration (SOC 2, HIPAA, GDPR, PCI-DSS, SEC)Post-Incident Metrics Tracking (MTTR, Recurrence Rate, Recommendation Completion Rate)
RELATED TOBusiness Continuity and Disaster Recovery Planning
CONSTRAINSReturn to Normal Operations