Which IR phase results in the formal written documentation?

Which IR phase results in the formal written documentation?

• A. Reporting
• B. Seizure
• C. Acquisition
• D. Analysis

Answer: (A)

The main idea is that final, official records of what happened and what was done are produced during the reporting phase. After collecting and examining evidence, investigators compile a formal written document that captures the incident timeline, findings, actions taken (containment, remediation), evidence inventory and chain of custody notes, and recommendations for prevention. This written report provides an auditable, communicable record for stakeholders and for future improvement. Seizure and acquisition focus on securing and copying data to preserve it, while analysis interprets the data to determine cause and impact. Those steps feed into the report, but the formal written documentation itself is produced during the reporting phase.

The main idea is that final, official records of what happened and what was done are produced during the reporting phase. After collecting and examining evidence, investigators compile a formal written document that captures the incident timeline, findings, actions taken (containment, remediation), evidence inventory and chain of custody notes, and recommendations for prevention. This written report provides an auditable, communicable record for stakeholders and for future improvement.

Seizure and acquisition focus on securing and copying data to preserve it, while analysis interprets the data to determine cause and impact. Those steps feed into the report, but the formal written documentation itself is produced during the reporting phase.