Phases
Your response policies might go through stages, where the initial tasks might be to gather supporting information during assessment to verify the event. After gathering information, your policies might require more action-oriented tasks.
You use Phases to define each stage of an incident response, essentially capturing the general intent of the response action. Phases logically and visually organize tasks within a playbook, which also helps leadership and management to be able to identify the current work state of the incident.
Like incident types, the phases you need for your environment are largely dependent on your organization’s response approach and tracking methods.