How Incident Response works
Three-step view of how it operates in practice.
- Prepare. Before an incident: playbooks, on-call rosters, vendor contracts, communication templates, table-top exercises.
- Detect & contain. When something happens: investigate the alert, scope the compromise, isolate affected systems, stop the bleed.
- Eradicate & recover. Remove the attacker’s persistence, restore from clean backups, harden against repeat, and document lessons learned.
Why Incident Response matters
The cost of an incident is largely decided in its first hours: an organization that knows who to call, what to isolate, and what not to touch resolves in days what an unprepared one drags out for weeks. IBM's breach research consistently finds that a tested response plan is among the biggest single cost reducers, and for a smaller business, the plan is mostly paper and practice, not new spending.
The four phases of the NIST IR lifecycle
- Preparation. Everything done before anything goes wrong: playbooks, contact trees, insurance and legal contacts on file, and tabletop exercises that rehearse the plan.
- Detection & Analysis. Recognizing that an event is actually an incident, scoping how far it reaches, and deciding severity. Most wasted time in real incidents is lost here.
- Containment, Eradication & Recovery. Stopping the spread, removing the attacker's footholds, and restoring clean systems, in that order. Recovering before eradicating invites round two.
- Post-Incident Activity. The honest review afterward: what the timeline really was, what worked, and which fixes prevent a repeat. Skipping this is how organizations get breached the same way twice.
Common Incident Response mistakes
- The plan lives in one person's head. If your most senior technician is on a plane when the incident starts, an undocumented plan is no plan. Write it down, print it, the network may be down, and make sure at least two people can run it.
- Wiping machines before preserving evidence. Reimaging the infected laptop feels productive but destroys the forensic record your insurer, your lawyer, and your investigators need. Isolate first, image and preserve, then rebuild.
- Ignoring the notification clocks. Regulators, state breach laws, and insurance carriers all impose deadlines that start at discovery, some measured in days. Build the who-to-notify-when list into the plan so legal obligations aren't researched mid-crisis.