NIST SP 800-61r2 defines the IR lifecycle in four phases. Which order is correct?

• 1Detection → Eradication → Containment → Recovery
• 2Preparation → Detection & Analysis → Containment, Eradication & Recovery → Post-Incident Activity
• 3Identification → Reporting → Backup → Closure
• 4Plan → Implement → Test → Audit