Incident Lifecycle

[Brian E]

Mailer: SecurityFocus

Anyone have comments about the life cycle of a 
security incident?

SANS describes the lifecycle as:
1. Preparation
2. Identification
3. Containment
4. Eradication
5. Recovery
6. Follow-up

Any other models for the lifecycle of a security 
incident?

Regards,
Brian