What is incident response?
Incident response is the structured process of identifying, containing, investigating, and recovering from a cyber incident.
Simple example
A business discovers a compromised email account and follows a plan to secure the account, preserve evidence, notify affected parties, and prevent recurrence.
Why it matters
A calm, structured response reduces damage, avoids rushed decisions, and improves recovery.
Common warning signs
- The activity is unexpected or unusual for the business context.
- The request or system behaviour creates pressure to act quickly.
- Normal approval, verification, or security processes are bypassed.
- There are signs of unauthorised access, data exposure, or system change.
- Staff are unsure whether the request, message, or system behaviour is legitimate.
Cyber Doc view
This term should be understood in business context, not only as a technical issue. Good protection usually combines clear processes, appropriate technical controls, staff awareness, and a calm response plan.
What to do
Proactive steps
- Create an incident response plan.
- Define who makes decisions during an incident.
- Keep contact details for IT, legal, insurers, and responders available.
- Test the plan with simple tabletop exercises.
- Maintain useful logs and backups.
Reactive steps
- Contain the issue before making broad changes.
- Preserve evidence and timelines.
- Engage appropriate technical and business stakeholders.
- Communicate clearly with affected parties.
- Review lessons learned after recovery.
Related terms
- Containment
- Recovery
- Evidence preservation