Incident response (IR) is the organized process of preparing for, detecting, containing and recovering from cybersecurity incidents, and learning from them to prevent repeats.
How incident response works
The best-known framework is NIST SP 800-61, updated in 2025 to align with the NIST Cybersecurity Framework 2.0. Its classic lifecycle, like the six-step SANS model, includes:
- preparation – plans, roles, contacts, tools, logging and backups ready before anything happens;
- detection and analysis – confirming an incident, understanding its scope and severity;
- containment – isolating infected hosts, blocking accounts and C2 traffic;
- eradication and recovery – removing malware and backdoors, restoring systems, monitoring for return;
- post-incident activity – a lessons-learned review and improved defences.
Digital forensics (together, DFIR) preserves evidence: memory images, disk copies and logs from the SIEM and EDR.
Why incident response matters for security
A well-prepared team turns chaos into a controlled process and shortens downtime – in a ransomware attack every hour counts. Incident response also has legal deadlines: under the GDPR, personal data breaches must be reported to the authority within 72 hours, and the EU NIS2 directive requires an early warning within 24 hours for significant incidents. Mistakes such as wiping systems too early or alerting the attacker can destroy evidence or trigger faster encryption.
Best practices
- Write an incident response plan with clear roles and keep offline copies of contacts and procedures.
- Practise with tabletop exercises, including management, legal and communications.
- Sign a retainer with an external IR firm before you need one.
- Keep logs and backups where the attacker cannot delete them.
