Arrange the standard phases of the incident response lifecycle in the correct chronological order, from initial readiness through post-incident improvement.

### The order 1. **Prepare and train the people who will manage incidents**: readiness must exist before an incident occurs. 2. **Identify and analyse the incident**: the organisation needs to understand what is happening before selecting a response. 3. **Coordinate communications and response activity**: people and stakeholders need aligned instructions and information. 4. **Mitigate the incident's impact**: actions limit continuing harm. 5. **Restore systems and operations using tested recovery plans**: recovery returns required services to use. 6. **Review measures and lessons to improve future plans**: evaluation informs improvement after the event or exercise. ### The concept Actual incidents may require steps to overlap or repeat. This order represents the broad logic of preparedness, response, recovery, and improvement rather than a rigid checklist for every event. ### Remember Prepare first, manage and limit the incident, restore service, then learn from the outcome.