XYZ Inc.

XYZ Inc. was affected by a malware attack and James, being the incident handling and

response (IH&R) team personnel handling the incident, found out that the root cause of

the incident is a backdoor that has bypassed the security perimeter due to an existing

vulnerability in the deployed firewall. James had contained the spread of the infection

and removed the malware completely. Now the organization asked him to perform

incident impact assessment to identify the impact of the incident over the organization

and he was also asked to prepare a detailed report of the incident.

Which of the following stages in IH&R process is James working on?