English
Menu

What is Incident response?

The series of activities carried out when a security incident such as a cyber attack occurs: finding the damage and stopping it from spreading, removing the cause and restoring operations, and applying the lessons learned. The second revision of the US NIST SP 800-61 (2012) presents it in four phases (preparation; detection and analysis; containment, eradication and recovery; and post-incident activity), and the third revision (2025) reorganized it in line with the Cybersecurity Framework (CSF) 2.0. Within an organization the CSIRT leads it, in cooperation with the SOC, system owners, legal, public relations and management.

Japanese name: インシデントレスポンス

Incident response appears in 2 practice questions across 1 topic, including Cyber Attacks and Defense in Practice.

Field: Cyber Attacks and Defense in Practice

Preparation decides the outcome

How quickly an organization can respond depends greatly on preparation before an incident. Contact lists and decision authority, procedures (playbooks), log collection and retention, backups, investigation tools and the contacts of external specialists and the police are set in advance and checked through exercises such as tabletop exercises.

Containment and preserving evidence

Containment, which stops the spread of damage, uses measures such as disconnecting devices from the network, disabling accounts and blocking traffic. However, wiping or powering off right away destroys the evidence needed to trace the intrusion path (memory contents and logs), and the attacker may get back in because the cause was never removed. The order of investigation and containment is decided according to the situation.

Post-incident activity

After the response, the team reviews what happened, what worked and what was lacking, aiming to improve the system rather than to blame individuals. The results feed into revisions of detection rules, playbooks and system configurations, and improvement is checked with metrics such as the mean time to detect.

Try it: questions about Incident response

The second revision (Rev. 2) of SP 800-61, the incident response guide published by the US NIST in 2012, presents incident response as a cycle of four phases. Which of the following gives the phases in the correct order?

  1. ADetection and analysis → preparation → post-incident activity → containment, eradication and recovery
  2. BPreparation → detection and analysis → containment, eradication and recovery → post-incident activity
  3. CContainment, eradication and recovery → preparation → detection and analysis → post-incident activity
Show answer and explanation

Answer: B. Preparation → detection and analysis → containment, eradication and recovery → post-incident activity

SP 800-61 Rev. 2 presents four phases: "preparation", which sets up the organization, procedures and tools; "detection and analysis", which judges from alerts and logs whether something is an incident and estimates its impact; "containment, eradication and recovery", which stops the damage from spreading, removes the cause and restores operations; and "post-incident activity", which organizes the lessons learned for next time. There is back-and-forth between detection and analysis and containment, eradication and recovery, and the lessons from post-incident activity are fed back into preparation to improve detection rules and procedures. The third revision (Rev. 3), published in April 2025, reorganized the guidance around the functions of NIST's Cybersecurity Framework (CSF) 2.0, but the four-phase model is still widely used.

FAQ

Is incident response the same as incident management in IT service management?

They overlap but are not the same. Incident management in ITIL and similar frameworks aims to restore normal service as quickly as possible after any interruption, including failures. Security incident response adds removing the attacker, preserving evidence and reporting under laws and regulations, so the CSIRT leads it with dedicated procedures.

If we are hit by ransomware, will paying the ransom speed up recovery?

Paying does not guarantee that the data can be decrypted, nor that a promise not to publish stolen data will be kept. Payment funds further attacks, and depending on who receives it, it may cause legal problems. Many public authorities advise against paying, and preparation assumes recovery from backups kept disconnected from the network.

Incident response in the explanations

Questions that mention Incident response (2)

  1. The second revision (Rev. 2) of SP 800-61, the incident response guide published by the US NIST in 2012, presents incident response as a cycle of four phases. Which of the following gives the phases in the correct order?
  2. Which of the following correctly describes the difference in roles between a CSIRT and a PSIRT set up within an organization?

Books on Cyber Attacks and Defense in Practice Ad

As an Amazon Associate I earn from qualifying purchases.

Comparisons that include this term

Related terms

Cyber Kill Chain Digital forensics EDR (endpoint detection and response) Indicator of compromise (IoC) Intrusion detection system (IDS) Lateral movement MITRE ATT&CK Penetration testing SBOM (software bill of materials) Security operations center

Back to the glossary