Security+ 801 Countdown, T-9: Incident Response Adds Negotiation, Notification, and the PIR

Incident response is the organized set of activities an organization uses to prepare for a security incident, recognize that one is underway, work out what happened, stop it from spreading, remove its cause, restore service, tell the people who must be told, and record what was learned. Every other control on the exam exists to make incidents rarer or smaller; incident response is what runs when those controls are not enough, which is why the topic calls for defined roles, written procedures, and rehearsal rather than improvisation. SY0-801 objective 4.7, “Summarize concepts associated with incident response activities,” expands the topic to eight headings, adding Negotiation and Notification/external reporting outright and adding Post-incident reporting, or PIR, under Post-incident (CompTIA 2025).

Read top to bottom, the eight headings (Preparation, Identification, Investigation, Containment, Negotiation, Eradication/recovery, Notification/external reporting, and Post-incident) describe a ransomware case as it actually runs. An advisory tips you off. Evidence has to survive litigation. Someone talks to the extortionist. Counsel starts regulatory clocks with different triggers, such as GDPR’s 72 hours from awareness and the SEC’s four business days from a materiality decision. Then someone writes the report that the board, the regulator, and the next tabletop exercise will all read.

CompTIA’s grouping is not the only way to carve up the work, and CompTIA never calls its headings phases or a sequence. NIST SP 800-61r3 (April 2025) superseded the 2012 Rev. 2 and its four phases; Rev. 3 has no phase list at all. It organizes response by the six CSF 2.0 Functions and notes that recovery, once done in a day or two, now “often takes weeks or months,” so lessons should be shared as soon as they are identified (NIST 2025). The SANS 504-B cheat sheet keeps six steps (Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned) and files root cause under Eradication (SANS 2016). The sections below follow CompTIA’s headings, which are the ones the exam uses, and borrow NIST’s definitions where CompTIA gives only a word.

Preparation: roles, playbooks, and exercises

Preparation is everything done before an incident so that the response does not have to be invented under pressure. CompTIA lists six items under it: Training, Testing, Tabletop exercises, Playbooks, Simulation, and Roles. The last of these decides how the others go, because the hardest calls in a ransomware case (isolate a production system, pay or refuse, disclose or wait) are decisions about authority, not technology.

CompTIA lists only the word “Roles.” NIST SP 800-61r3 Section 2.2 gives examples: leadership, which may hold “decision-making authority on high-impact response actions”; incident handlers on staff, on contract (such as an MSSP-run SOC), or on call; technology professionals; legal; public affairs; human resources; physical security; and asset owners. “Incident commander” is common practice, not a NIST role. The payment and materiality decisions later in this post are the reason to settle these roles in advance; they are far easier to assign before an incident than during one.

A playbook is the written procedure a responder follows for a given situation; Rev. 3 describes playbooks as “actionable steps or tasks for people to perform” (NIST 2025). The runbook and SOP distinction is at T-7. Training prepares the people, and testing exercises the plan, in two forms. A tabletop exercise is discussion-based: people with roles in a plan talk through a facilitator’s scenario (NIST n.d.-b). A simulation is hands-on practice, in which the team performs the actions rather than describing them. A plan that has only been read is a hypothesis; an exercise is the test.

Identification and investigation: learning versus proving

Identification is how an organization learns that something is wrong and declares an incident. Under DE.AE-08, incidents are declared when adverse events meet defined criteria (NIST 2025), so declaration is a decision against a written threshold, not a feeling that things look bad. CompTIA lists four sources under the heading: Detection, Internal advisory, External advisory, and Threat hunting. Detection is alert-driven; a sensor, a log rule, or an endpoint agent fires. Threat hunting is proactive and hypothesis-driven: an analyst starts from a guess about how an attacker might already be present and goes looking for evidence instead of waiting for an alert.

CompTIA does not define the two advisories, so this is an interpretation: an internal advisory comes from inside (a SOC bulletin, an employee report, a hunt finding), and an external advisory comes from a vendor, a researcher, or a government. The clearest example of the external kind is a joint government bulletin. Joint advisory AA23-325A (November 21, 2023), on LockBit 3.0 affiliates exploiting Citrix Bleed (CVE-2023-4966), shipped IOC tables (indicators of compromise) plus STIX files to match against your own logs (CISA and FBI 2023). When an analyst takes an indicator from that advisory and finds it in the firewall log, the advisory is the source and the match is identification; nothing has yet been proven about scope or cause.

Proving is Investigation, which is evidence-based analysis of what happened and why (CSF RS.AN). CompTIA lists Digital forensics, Chain of custody, E-discovery, and Preservation under it. Digital forensics is the disciplined acquisition and analysis of digital evidence. Preservation protects evidence from alteration or loss; e-discovery produces electronically stored information for litigation (in U.S. federal courts, under FRCP Rule 34); legal hold, the related compliance duty, is covered at T-4. Chain of custody “tracks the movement of evidence through its collection, safeguarding, and analysis lifecycle” by recording each handler, the time, and the purpose (NIST n.d.-a). In practice it is a log that travels with the evidence:

CHAIN OF CUSTODY   Case IR-2026-0303-01   Item E-001
Description: disk image of fs01.example.com (198.51.100.20), fs01.E01
SHA-256 at acquisition: 15cfff826849a8126e8e0a3bd40fd650d21177a16fba363512e831e4773c22f9
Date/time (UTC)    Released by         Received by          Purpose
2026-03-03 01:42   R. Diaz (IR)        R. Diaz (IR)         Acquired from fs01
2026-03-03 06:15   R. Diaz (IR)        Evidence locker 2    Secure storage
2026-03-04 13:00   Evidence locker 2   K. Osei (DFIR firm)  Analysis; hash re-verified, match

Each receiving analyst reruns sha256sum fs01.E01 and logs the result. The hash proves the bits did not change; the rows prove who could have changed them, so a missing row is a break in custody even when the hash matches. The distinction I want a reader to carry out of this section is simple: Identification is how you learn, Investigation is how you prove, and the second has to stand up in front of a lawyer who was not in the room.

Containment, eradication, and recovery

Containment is “preventing the expansion of an incident,” such as quarantining malware or moving an endpoint to an isolated remediation network (RS.MI-01). CompTIA’s single sub-bullet, Quarantine/isolation, names the two usual forms: quarantine confines a suspect file or process where it cannot execute or spread, and isolation cuts a host or segment off from the rest of the network while it is examined. One containment decision is how to isolate without tipping off the actor. If the intruder is reading your email or chat, planning the isolation there announces it, so CISA advises out-of-band communication while isolating (CISA 2023).

Eradication removes the cause, such as malware and breached accounts (RS.MI-02, Respond); recovery restores and validates, including checking backup integrity before use (RC.RP-03 in Recover; NIST 2024). The integrity check matters because a backup taken after the intrusion began can restore the attacker’s foothold along with the data. CompTIA merges eradication and recovery under one heading; NIST and SANS keep them apart, and the timescale explains why. Removing the cause can be quick; rebuilding and validating every affected system is the part that Rev. 3 says now “often takes weeks or months” (NIST 2025).

Negotiation

Negotiation is the managed process of communicating with an extortion actor, which can buy time and intelligence whether or not payment follows. CompTIA gives the heading no sub-bullets and no definition, and neither NIST SP 800-61r3 nor CSF 2.0 has a named element for it; Rev. 3 contains no form of “negotiate.” Basically, the standards tell you how to contain and recover and leave the conversation with the criminal to counsel, the insurer, and law enforcement. What the sources do support falls into four groups.

Authority and law enforcement come first. Decide in advance who may authorize payment; Change Healthcare’s CEO testified that “the decision to pay a ransom was mine” (Witty 2024). Report to law enforcement early, whatever the payment decision. In sanctions enforcement, OFAC treats a prompt, complete report as “a significant mitigating factor” (OFAC 2021), and federal law enforcement can tell you whether a decryptor already exists, which can make the whole negotiation unnecessary (CISA 2023).

Sanctions screening is the legal core. Paying is not illegal per se, but U.S. persons are generally prohibited from dealing with parties on OFAC’s Specially Designated Nationals (SDN) List or with embargoed parties, civil liability is strict (not knowing that the recipient was sanctioned is no defense), and license applications face “a presumption of denial” (OFAC 2021). Screening the wallet and the group against the SDN List is therefore part of the negotiation, not an afterthought once a price is agreed.

Evidence handling continues through the conversation. Preserve the ransom note, actor communications, wallet addresses, and decryptor files, which AA23-325A asks victims to share (CISA and FBI 2023). Keep the cyber insurer informed; CISA lists it as a stakeholder, and any consent requirement depends on the policy (CISA 2023).

Finally, expect no guarantee: payment “does not guarantee victim files will be recovered” (CISA and FBI 2023). Two inferences follow, labeled as such. Under double extortion (CISA’s term for exfiltrating and encrypting data, then threatening to release it), the actor keeps its copy, so payment cannot compel deletion. And negotiation usually runs in parallel with containment and eradication, though CompTIA lists it between them.

Notification clocks and the post-incident report

Who must be told, and when

CompTIA names four audiences under Notification/external reporting: stakeholders, customers, law enforcement, and “Mandatory,” meaning legally required reporting (unrelated to mandatory access control in 4.5). The first three are governed by contracts, policy, and judgment. The fourth is a set of statutory clocks, and the detail that matters is that each clock starts from a different trigger. Consider a fictional case: Example Health, Inc. is a U.S. public company (not a smaller reporting company) and a HIPAA covered entity with EU patients and a NYDFS-licensed subsidiary. Exfiltration of patient records is confirmed Tuesday, March 3, 2026, 14:00 UTC.

Rule	Clock starts at	Deadline in this case
GDPR Art. 33	Controller becomes aware	Fri Mar 6, 14:00 UTC, “where feasible”
23 NYCRR 500.17(a)	Determining an incident occurred	Fri Mar 6, 14:00 UTC
SEC Form 8-K Item 1.05	Materiality determined, Thu Mar 5	Wed Mar 11, four business days
HIPAA, 45 CFR 164.404	Discovery	Sat May 2, an outer limit
23 NYCRR 500.17(c)	Extortion payment, Mon Mar 9, 16:00	Tue Mar 10, 16:00; written justification Wed Apr 8
CIRCIA, 6 U.S.C. 681b	Reasonable belief (72 h); payment (24 h)	Not yet in force

The SEC counts business days (March 6, 9, 10, and 11), and materiality must be determined “without unreasonable delay after discovery” (SEC 2023). HIPAA’s 60 calendar days is a ceiling; notice is still due “without unreasonable delay,” and HHS is notified contemporaneously at 500 or more individuals. GDPR allows information in phases, and Article 34 notice to individuals applies only on high risk, with no hour count (EDPB 2023). CIRCIA’s statute sets 72 and 24 hours, but as of October 12, 2026 CISA said it “continues to work on the final rule” and that reports are not required until its effective date (CISA 2026). Virginia Code 18.2-186.6 adds a state layer: notice “without unreasonable delay,” plus consumer reporting agencies above 1,000 persons.

Notice how the triggers differ. GDPR and NYDFS start when the organization knows; the SEC starts when the company decides the incident is material, not when it discovers it; HIPAA starts at discovery; and NYDFS’s second clock starts at the moment of payment, which ties Notification back to Negotiation. A team that tracks one “72-hour clock” will miss at least two of these.

Lessons learned, root cause, and the PIR

Post-incident separates three things. Lessons learned is the meeting and process; root cause analysis finds “underlying or systemic root causes” (RS.AN-03); the PIR is the written deliverable, which NIST RC.RP-06 calls an after-action report documenting “the incident itself, the response and recovery actions taken, and lessons learned” (NIST 2025). A workable outline: executive summary, timeline, scope and impact, root cause and contributing factors, what worked and what did not, notifications made with legal basis, corrective actions with owners and due dates, and an evidence index. The evidence index is where the chain of custody log from the Investigation section ends up, and the notifications section is where each clock above is shown to have been met.

A fictional root-cause statement, modeled on the testified Change Healthcare pattern: “Valid stolen credentials were accepted by an internet-facing remote-access portal excluded from the MFA policy. Corrective action: enforce MFA on all remote access (owner: IAM lead).” A good statement names the mechanism rather than the attacker, and it pairs the cause with a corrective action that has an owner. Because Rev. 3 expects recovery to run for weeks or months, lessons do not wait for the final PIR; they are shared as soon as they are identified (NIST 2025).

What you need to know for SY0-801

• Headings, read top to bottom: Preparation, Identification, Investigation, Containment, Negotiation, Eradication/recovery, Notification/external reporting, Post-incident.
• Identification is how you learn (detection, advisories, hunting); Investigation is how you prove (forensics, chain of custody, e-discovery, preservation).
• A vendor bulletin or government advisory with IOCs is an external advisory under Identification; telling regulators is Notification.
• A tabletop exercise is discussion-based; a simulation is hands-on practice. Both are forms of testing under Preparation.
• Chain of custody records each handler, the time, and the purpose; the hash proves integrity, and the custody rows prove possession.
• Quarantine and isolation contain; eradication removes malware, persistence, and rogue accounts.
• Negotiation means communicating with the actor, not paying; sanctions screening and early law-enforcement contact belong to it.
• Clock triggers differ: GDPR awareness, NYDFS determination, SEC materiality (business days), HIPAA discovery, payment for NYDFS 24-hour notices.
• “Mandatory” under Notification means legally required reporting, not mandatory access control.
• PIR means Post-incident Reporting on this exam, the written report; RCA feeds it, and lessons learned is the meeting.
• Legal hold is tested under 5.4 Legal compliance (T-4), not under 4.7.

Check yourself

1. A SOC receives a joint government advisory with IOC tables and STIX files for a ransomware affiliate, and an analyst matches one IOC to an outbound connection in the firewall log. Which SY0-801 4.7 heading covers this activity?

• A. Investigation.
• B. Identification.
• C. Notification/external reporting.
• D. Post-incident.

Answer: B. An external advisory is an inbound source that triggers identification. Notification is outbound, and Investigation is the later evidence work.

2. A public company that is not a smaller reporting company determines on a Thursday that a ransomware incident is material. No federal holiday falls in the following seven days. When is the Form 8-K Item 1.05 report due?

• A. Sunday, 72 hours later.
• B. Monday.
• C. Wednesday of the following week.
• D. 60 calendar days after discovery.

Answer: C. Item 1.05 runs four business days from the materiality determination: Friday, Monday, Tuesday, Wednesday. The 72-hour and 60-day clocks belong to GDPR, NYDFS, and HIPAA.

3. During negotiation, the response team learns the extortion group’s wallet is linked to a party on the OFAC SDN List. Which statement is most accurate?

• A. Ransom payments are illegal for all U.S. companies, so negotiation must stop.
• B. Payment could violate OFAC regulations under strict liability, and a license application faces a presumption of denial.
• C. Payment is permitted once the cyber insurer consents.
• D. Reporting to the FBI after paying removes all sanctions liability.

Answer: B. OFAC’s 2021 advisory describes strict civil liability and a presumption of denial for licenses. Payment is not illegal per se, insurer consent is contractual, and reporting mitigates rather than immunizes.

This is T-9 of the Security+ 801 Countdown: one change from SY0-701 to SY0-801 every morning until the new exam launches on November 17, 2026. Tomorrow, T-8: From Telemetry to Evidence With syslog, Memory Dumps, and Log Parsing. New here? Start with T-38: The Blueprint Was Reweighted and Trimmed to 27 Objectives.

References

CISA (Cybersecurity and Infrastructure Security Agency). 2023. “#StopRansomware Guide.” CISA, September 2023.

CISA (Cybersecurity and Infrastructure Security Agency). 2026. “Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA).” CISA. Accessed October 12, 2026.

CISA and FBI. 2023. “#StopRansomware: LockBit 3.0 Ransomware Affiliates Exploit CVE 2023-4966 Citrix Bleed Vulnerability.” Cybersecurity Advisory AA23-325A.

CompTIA. 2023. CompTIA Security+ SY0-701 Certification Exam Objectives. Version 5.0.

CompTIA. 2025. CompTIA Security+ SY0-801 V8 Certification Exam Objectives. Document Version 2.0.

EDPB (European Data Protection Board). 2023. Guidelines 9/2022 on Personal Data Breach Notification under GDPR. Version 2.0, adopted March 28, 2023.

NIST (National Institute of Standards and Technology). 2024. The NIST Cybersecurity Framework (CSF) 2.0. Cybersecurity White Paper 29.

NIST (National Institute of Standards and Technology). 2025. Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile. Special Publication 800-61r3.

NIST (National Institute of Standards and Technology). n.d.-a. “Chain of Custody.” CSRC Glossary. Accessed October 12, 2026.

NIST (National Institute of Standards and Technology). n.d.-b. “Tabletop Exercise.” CSRC Glossary. Accessed October 12, 2026.

OFAC (U.S. Department of the Treasury, Office of Foreign Assets Control). 2021. Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments. September 21, 2021.

SANS Institute. 2016. SANS 504-B Incident Response Cycle: Cheat-Sheet. Version 1.0.

SEC (U.S. Securities and Exchange Commission). 2023. Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure. Release No. 33-11216.

Witty, Andrew. 2024. Testimony Before the Senate Finance Committee. May 1, 2024.