Actions to take after an attack - Word Drop

After an attack, an organisation follows a set of actions to resolve the situation and reduce the chance of it happening again. The first action is to ______ the attack, to find out what type of attack it was and which services are affected. This sets the ______ of the attack, from low risk to severe, so that the response matches the risk.

The organisation must then ______ to the incident. It informs ______, such as customers, suppliers and employees, and reports the breach to the appropriate authorities, including the police. Interested parties are kept updated as more information comes from the investigation.

To manage the incident, the priority is to ______ the threat at its source, so that it cannot spread. How the incident is managed depends on its nature and severity, as shown by the investigation. Infected systems are disconnected from the network, and a ______ blocks unauthorised traffic. Any ______ of the attack must be ______, so that it can be used as proof in a criminal investigation.

The organisation follows its disaster recovery policy, which sets out the ______ action needed, such as new hardware or staff training. Once recovery is complete, the final stage is to ______ what went wrong, so that the same attack can be ______ next time. As a result, it updates its policies and its ______, the agreed steps staff must follow.