Glossary term
Incident Response
Subject: Technology, Cyber and Data, Cyber Risk and Incident Response
Also known as: Incident Management
Incident response is the organised process of detecting, assessing, containing and recovering from a security incident or operational disruption, and learning from it afterwards.
Explanation
Response follows a lifecycle: preparation (plans, tools, training), detection and analysis, containment, removal of the cause, recovery to normal service, and post-incident review. Incident management is the wider discipline in IT service teams that logs, prioritises and resolves any disruption; security incidents are a subset handled with extra care for evidence and legal duties. A key early step is severity classification: a scale, often from low to critical, based on the number of people or systems affected, the sensitivity of data, the impact on services and the legal duties triggered. Severity decides who is woken, how fast to act, whether executives and regulators are told and what resources are committed. Teams keep a timeline of actions and decisions, since it feeds reports and any legal proceedings. Losses usually grow the longer an incident stays open, which is why the first minutes go on classification rather than diagnosis.
Example
An analyst notices a privileged account logging in from two countries within minutes. The duty manager classifies it as high severity, because the account reaches payroll data, and starts the response. The account is disabled, passwords are reset, logs are preserved, and the team confirms that no data left the network. The incident closes with a written timeline and review.
Not to be confused with
- Disaster Recovery Plan (DRP)
- Disaster recovery restores systems after a major failure; incident response deals with the event itself, including investigation, and may or may not need recovery.