What is the focus of the Assess phase in incident response?

• A. Collect facts to establish the timeline, scope, and impact of the incident without damaging the investigation.
• B. Contain the threat immediately.
• C. Deploy a new AI model.
• D. Notify stakeholders only.

Answer: (A)

Assess in incident response is focused on gathering and preserving the facts to understand what happened: when the incident began, how far it spread, and what impact it has on the organization. This stage is about building a clear, evidence-based understanding while ensuring the investigation isn’t compromised or altered, so chain of custody remains intact for later analysis and attribution. Containment, by contrast, is a separate step that aims to stop the incident from causing more harm, rather than assessing its full scope. Deploying a new AI model has no relevance to the assessment process, and notifying stakeholders is important but belongs to communications and coordination rather than the core assessment effort. Therefore, the best choice is collecting facts to establish the timeline, scope, and impact without damaging the investigation.