Arrange these response activities in the usual sequence: preparation, containment, detection and analysis, recovery, eradication, and post-incident activity.

### The order 1. **Preparation**: Plans, roles, and readiness should exist before an incident is discovered. 2. **Detection and analysis**: Responders identify the incident and assess its scope before selecting controls. 3. **Containment**: The team limits spread and damage while preserving options for investigation. 4. **Eradication**: The cause and remaining threat are removed after the immediate spread is controlled. 5. **Recovery**: Services and data are restored and checked after threat removal. 6. **Post-incident activity**: The organization reviews the response and records improvements after immediate handling. ### Watch out A real incident may require overlap or repeated steps, but this sequence captures the usual logic: understand, limit, remove, restore, learn. ### Terms - **Eradication**: Removal of the threat and the conditions that allowed it. ### Remember Do not restore broadly before you have controlled and removed the threat.