PICERL
Definition
Acronym for the six SANS IR stages: Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned. The model is cyclical: the final stage feeds back into the first.
- Stages
- Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned
- Source
- SANS Institute incident response model
- Structure
- Cyclical, final stage feeds back into first
- Field
- Digital forensics and incident response
Common questions
How does the cyclical nature of PICERL affect how a response team operates?+
Because Lessons Learned feeds back into Preparation, a team using PICERL is expected to update its playbooks, tooling, and detection rules after every incident, rather than treating each response as a one-off exercise, so the model builds organisational improvement into the process itself.
What distinguishes Containment from Eradication in the PICERL model?+
Containment focuses on stopping the immediate spread or damage, such as isolating an infected host from the network, while Eradication removes the actual root cause afterward, such as deleting malware or closing the vulnerability that was exploited. Containment buys time; eradication finishes the job.
Related terms
- After-Action Report (AAR)
- The formal document produced during Lessons Learned that records the incident timeline, decisions made, outcomes, and recommended improvements. The AAR drives updates...
- Containment Strategy
- A deliberate decision about how to limit an incident's spread, balancing the need to stop harm immediately against the risk of alerting...
- Eradication
- The phase in which the root cause of an incident is removed from the environment: deleting malware, patching exploited vulnerabilities, revoking compromised...
- Incident Declaration
- The formal decision, made during the Identification stage, that a detected event meets the organisation's criteria for a security incident. Declaration triggers...
- NIST SP 800-61
- The US National Institute of Standards and Technology's Computer Security Incident Handling Guide. It defines a four-phase IR lifecycle: Preparation; Detection and...