What is incident response (IR)?
Incident response (IR) is the plan and process an organization follows when a security incident happens: preparation, detection and analysis, containment, eradication, recovery, and lessons learned. NIST SP 800-61 is a widely used guide.
How it works
An IR plan names who leads, who decides, how to communicate internally and externally, and when to involve legal, insurers, regulators and law enforcement.
Plans that are rehearsed, through tabletop exercises and simulations, work far better under pressure than plans that have only been written.
Why it matters
How fast an organization contains an incident largely decides what it costs. People who know their role act faster.
