The last 3 are recovery, remediation, lessons learned. The current exam lists a 7-step lifecycle,
but does not include the first step in most incident handling methodologies preparation. Preparation
> Detection (Identification) > Response (Containment) > Mitigation (Eradication) >
Reporting > Recovery > Remediation > Lessons Learned (Post-incident Activity, Post Mortem,
or Reporting).