Incident response process: preparation, detection, containment, eradication, recovery and lessons learned

Incident response (IR) is the organized approach to handling security incidents so that damage, cost and recovery time are kept low. NIST SP 800-61 describes a widely used life cycle: preparation; detection and analysis; containment, eradication and recovery; and post-incident activity. The latest revision of 800-61 maps these activities to the NIST CSF functions, but the underlying steps are the same.