SANS has published an Incident Handler's handbook. The handbook defines the steps as follows:PreparationIdentificationContainmentEradicationRecoveryLessons Learned