Overview
Incident response (IR) is the organized process of preparing for, detecting, and handling security incidents. Its phases are widely modelled on the NIST incident-response lifecycle. This module walks through that lifecycle, beginning with the phase that determines everything else: preparation.
Learning objectives
- Define an incident and incident response.
- Explain the goal of the preparation phase.
- List key elements that must be in place before an incident.
Core concept
An incident is an event that actually or potentially harms the confidentiality, integrity, or availability of information or systems (distinct from a mere event, which is any observable occurrence). Preparation is the phase — done before any incident — that builds the capability to respond well.
A common lifecycle (NIST SP 800-61) is: Preparation → Detection & Analysis → Containment, Eradication & Recovery → Post-Incident Activity (lessons learned), and it is a cycle — lessons feed back into preparation.
How it works
Preparation puts the people, plans, and tools in place so that responders are not improvising during a crisis. Key elements:
- An incident-response plan and team with defined roles and authority.
- Runbooks/playbooks for common incident types.
- Contact lists and communication plans (internal, legal, executives, possibly law enforcement).
- Tooling and access — logging, monitoring, forensic and containment tools ready to use.
- Training and exercises — tabletop drills so the team has practised before a real event.
Practical example
Before any breach, a company writes an IR plan, forms a response team, builds playbooks for phishing and ransomware, and runs a tabletop exercise simulating a ransomware outbreak. When a real incident later occurs, the team already knows their roles, has the tools ready, and follows a rehearsed plan — turning potential chaos into a managed response.
Cybersecurity relevance
Preparation is where incident-response success is largely decided. Every later phase depends on decisions and investments made here (logging enables detection; playbooks enable fast containment; tested backups enable recovery). It is the practical culmination of the controls, policies, and procedures from earlier modules.
Common mistakes
- Having no plan or team, so response is improvised and slow.
- A plan that is never tested, discovering gaps during a real crisis.
- Missing logging or tooling, leaving responders blind when it matters.
Key takeaways
- An incident harms (or threatens) confidentiality, integrity, or availability; IR is the process of handling it.
- Preparation builds the plan, team, playbooks, tools, and training before any incident.
- The IR lifecycle is a cycle, and preparation underpins every later phase.
Check your understanding
- What distinguishes an "incident" from an ordinary "event"?
- Name three things that must be in place during preparation for effective response.