Incident Response Lifecycle
Definition
The structured sequence of phases NIST SP 800-61 defines for handling computer security incidents: Preparation, Detection and Analysis, Containment/Eradication/Recovery, and Post-Incident Activity. The lifecycle is cyclic; lessons from the final phase feed back into the first.
- Phases
- Preparation, Detection/Analysis, C/E/Recovery, Post-Incident
- Source standard
- NIST SP 800-61
- Structure
- Cyclic, not linear
- Feedback
- Post-incident lessons feed back into Preparation
Common questions
Why is the NIST lifecycle described as cyclic rather than a one-time sequence?+
Findings from the Post-Incident Activity phase, such as gaps in detection or missing playbooks, are fed back into Preparation, so each incident strengthens the organisation's readiness for the next one rather than ending the process.
How does this lifecycle relate to the SANS PICERL model?+
Both cover the same overall process, but NIST SP 800-61 groups Containment, Eradication, and Recovery into a single combined phase, while PICERL treats them as three separate stages.
Related terms
- Containment Strategy
- A deliberate decision about how to limit an incident's spread, balancing the need to stop harm immediately against the risk of alerting...
- Eradication
- The phase in which the root cause of an incident is removed from the environment: deleting malware, patching exploited vulnerabilities, revoking compromised...
- Incident Response Plan
- A formal document that defines an organisation's approach to incident handling: roles and responsibilities, escalation paths, communication procedures, legal and regulatory obligations,...
- Indicators of Compromise (IoCs)
- Artefacts observed on a network or system that suggest an intrusion or malicious activity has occurred, such as unusual outbound connections, known-malicious...
- Lessons-Learned Meeting
- A structured post-incident review, recommended by NIST within approximately two weeks of incident resolution, that examines what happened, what the response did...