Security Incident Response

A security incident is an event that harms, or threatens to harm, your systems, data, or operations. Incident response is the coordinated work that limits that harm and restores a trustworthy operating state.

Response is not a single emergency procedure. NIST places it across cybersecurity risk management. Preparation happens before an incident. Detection, response, and recovery happen during and after it. Lessons from each incident feed changes to governance, protection, and detection.

The operating model

Use a continuous loop:

1. Prepare. Define authority, roles, communication paths, evidence practices, tools, and recovery priorities.
2. Detect and validate. Collect signals, determine whether an incident exists, and record the reasoning.
3. Analyze and scope. Build a timeline. Identify affected assets, identities, data, and business services. State what remains unknown.
4. Contain. Limit further harm while preserving the ability to investigate and recover.
5. Eradicate and recover. Remove the cause and persistence, restore from trusted sources, validate controls, and monitor for recurrence.
6. Learn and improve. Capture decisions, outcomes, and corrective actions. Feed them into plans and controls.