Overview
Incident response (IR) is the organized process of detecting, containing, and recovering from security incidents. This module follows a widely used six-phase lifecycle — preparation, identification, containment, eradication, recovery, and lessons learned — and this lesson covers the first phase: preparation.
Learning objectives
- Define incident response and its six-phase lifecycle.
- Explain why preparation is the foundation of effective response.
- Identify what a SOC prepares before an incident occurs.
Core concept
Preparation is everything a SOC does before an incident so it can respond effectively when one occurs. It is the only phase performed in advance, and it determines how well every later phase goes. Preparation includes an incident-response plan (documented roles, decision authority, and steps), playbooks for common incident types, communication plans (who is notified and how), tooling and access (SIEM, EDR, logging, forensic tools) already in place, log retention sufficient for investigation, and training/tabletop exercises so responders know their roles. Because the six-phase lifecycle (preparation → identification → containment → eradication → recovery → lessons learned) is only as strong as its preparation, this phase is the foundation of the entire module.
How it works
During preparation, the SOC builds the capabilities response will depend on. It writes an IR plan defining roles (who leads, who investigates, who communicates), decision authority (who can authorize containment actions such as isolating a host), and escalation paths. It develops playbooks — step-by-step guides for common incidents (phishing, malware, account compromise) — drawing on the detection knowledge from earlier modules. It ensures detection and telemetry are ready: SIEM correlation, EDR on endpoints, IDS on the network, and log retention long enough to investigate. It establishes communication plans (internal stakeholders, legal, management, and — where relevant — external parties) and prepares secure channels. Finally, it runs training and tabletop exercises to rehearse the plan so that, when identification (next lesson) begins, responders act quickly and correctly rather than improvising. Good preparation shortens every later phase and reduces incident impact.
Practical example
A SOC prepares long before any breach: it documents an IR plan with clear roles and who may authorize a host isolation, writes playbooks for phishing and malware, confirms EDR and SIEM coverage with adequate log retention, sets up a communication plan, and runs a tabletop exercise where the team walks through a simulated incident. Months later, when identification flags a real compromise, the team already knows its roles, has a playbook to follow, and has the telemetry needed to investigate — so containment happens in minutes, not hours. The same incident at an unprepared organization (no plan, unclear authority, missing logs) would drag on and cause far more damage. This contrast shows why preparation is the foundation.
Cybersecurity relevance
Preparation is the foundation of the entire IR lifecycle: the quality of the plan, playbooks, tooling, log retention, communication, and training directly determines how fast and effectively the SOC identifies, contains, eradicates, and recovers from incidents. It ties together everything from earlier modules — detection (SIEM, EDR, IDS), telemetry, and safe-response concepts — into a ready-to-execute capability. Without preparation, responders improvise under pressure, miss evidence, and act without clear authority. With it, the later phases (identification through lessons learned) run smoothly, making preparation the single highest-leverage phase of incident response.
Common mistakes
- Treating IR as ad hoc — no documented plan, roles, or decision authority until an incident is underway.
- Inadequate log retention or tooling, so investigation lacks the telemetry it needs.
- Never rehearsing — writing a plan but never running tabletop exercises, so the team is untested.
Key takeaways
- Incident response follows a six-phase lifecycle: preparation, identification, containment, eradication, recovery, lessons learned.
- Preparation is the only phase done in advance and the foundation for all others: IR plan, roles/authority, playbooks, tooling, log retention, communication, and training.
- Strong preparation shortens every later phase and reduces impact; weak preparation forces responders to improvise under pressure.
Check your understanding
- What are the six phases of the incident-response lifecycle, and which is done in advance?
- Name three things a SOC prepares before an incident and explain how each helps a later phase.