Which statement best describes the Assess phase in incident response?

• A. The focus is to collect facts to establish the timeline, scope, and impact of the incident without damaging the investigation.
• B. The focus is to deploy containment measures immediately.
• C. The focus is to recalculate penalties for vendors.
• D. The focus is to archive data without review.

Answer: (A)

In incident response, the Assess phase is about understanding what happened and its effects while preserving evidence. The focus is on collecting facts to reconstruct the timeline, determine the scope of affected systems and data, and gauge the potential impact, all without altering or destroying evidence. This careful gathering helps establish how the incident unfolded and what needs to be protected or restored, and it sets the direction for containment and remediation. Immediate containment actions or penalties calculation fall outside this phase, and archiving data without review would skip the crucial analysis that informs the response.