Incident Response

Incident response is the organized approach to detecting, containing, eradicating, and recovering from cybersecurity incidents. An incident response plan defines the roles, responsibilities, procedures, and communication protocols your organization follows when a security event occurs — who does what, when, and how.

A good incident response plan covers preparation (training, tools, contacts), detection and analysis (identifying what happened), containment (stopping the damage), eradication (removing the threat), recovery (restoring normal operations), and lessons learned (improving for next time). For defense contractors, the plan must also address DoD notification requirements for CUI incidents.