What is Incident Response?

The NIST IR lifecycle (SP 800-61) defines four phases that map cleanly onto how a real incident unfolds. Preparation happens entirely before an incident: building the IR team, provisioning tools such as forensic imaging software, EDR isolation capability, and secure out-of-band communication channels in case email itself is compromised, and writing playbooks for likely scenarios like ransomware, business email compromise, or insider data theft. Detection and Analysis is where a SOC alert, a user report, or a threat intel tip gets validated as a real incident, scoped for severity and business impact, and formally declared. Containment, Eradication, and Recovery is the active response: stopping the spread, removing every trace of the attacker's access, and safely restoring systems to production. Post-Incident Activity closes the loop with a lessons-learned review, updated detection rules and playbooks based on what was actually observed, and any required regulatory notifications.

Preparation is where the difference between a controlled incident and a chaotic one is usually decided weeks in advance. Organizations that run tabletop exercises, walking a fictional scenario like a ransomware detonation through the full team without touching production systems, consistently find gaps such as missing contact information, unclear decision authority, or a playbook step that assumes a tool nobody actually has access to, before those gaps cost real time during an actual incident.

An IR team typically spans several roles working in parallel rather than sequentially: an IR lead coordinating the overall response and making go or no-go calls, security analysts handling investigation and technical containment actions, forensic analysts preserving and analyzing evidence without contaminating the chain of custody, legal counsel advising on regulatory notification obligations that vary sharply by jurisdiction and data type, communications staff managing internal and, if required, public messaging, and executives who own business-impact decisions like whether to pay a ransom or take a critical system offline.

Declaring something a formal incident rather than handling it as routine alert triage matters because it changes the process: incidents get a case number, a dedicated IR lead, documented chain of custody for evidence, and often legal and executive visibility that a routine alert never receives.