Incident Response (IR)
Definition
The organised methodology for handling and managing the aftermath of a security breach or cyberattack. IR encompasses preparation, detection, containment, eradication, recovery, and post-incident review, and is defined by standards including NIST SP 800-61 and ISO/IEC 27035.
- Phases
- Preparation through post-incident review
- Governing standards
- NIST SP 800-61, ISO/IEC 27035
- Scope
- Organised handling of security breaches
- Goal
- Contain damage, restore operations, preserve evidence
Common questions
How does incident response differ from general IT troubleshooting?+
IR follows a structured methodology aimed at containing an adversary, preserving evidence for potential legal action, and preventing recurrence, whereas routine troubleshooting focuses only on restoring service without those forensic and containment considerations.
Why do organisations align IR programs with standards like NIST SP 800-61?+
Aligning with a recognised standard ensures the process covers all necessary phases, supports regulatory and audit requirements, and gives responders a common, testable framework rather than an ad hoc reaction each time.
Related terms
- Breach Notification
- The legal obligation to inform regulators and affected individuals when personal data is compromised in a security incident. Timelines and thresholds differ...
- Chain of Custody
- The documented chronological record of who collected, handled, transferred, and examined a piece of evidence. For digital evidence, chain of custody includes...
- Dwell Time
- The period between an attacker gaining initial access and their detection. Reducing dwell time is a primary goal of threat hunting. The...
- Forensic Readiness
- The organisational state in which people, processes, and technology are prepared to collect and preserve digital evidence with minimum disruption to business...
- Proportionality
- The legal principle, central to European human rights law and to many constitutional systems, that any interference with a fundamental right must...