The incident response lifecycle (NIST SP 800-61)
In short: Incident response is a planned way to handle security incidents so damage is limited and the organisation recovers quickly. NIST SP 800-61 describes it as a cycle from preparation through detection, containment, eradication and recovery to lessons learned.
What incident response is
A security incident is an event that actually or potentially harms the confidentiality, integrity or availability of systems or data, or breaks security policy. Examples include ransomware, a stolen laptop with unencrypted data, or an attacker reading the finance director's email. Incident response (IR) is the organised way you handle it.
The best-known guide is NIST Special Publication 800-61 from the US National Institute of Standards and Technology. Revision 2 (2012) set out the four-phase lifecycle most courses teach. Revision 3 (2025) reorganises the guidance around the six functions of the NIST Cybersecurity Framework (CSF) 2.0: Govern, Identify, Protect, Detect, Respond and Recover. The core ideas are the same, and many exams still use the classic phases. ISO/IEC 27035 is the international equivalent.
The phases in practice
- Preparation: an approved plan, a trained team, contact lists, logging, EDR, backups, and tested playbooks. Most of the outcome is decided here, before any incident.
- Detection and analysis: an alert, user report or third party notice arrives. Confirm it is real, decide severity, and work out the scope: which systems, accounts and data are involved.
- Containment: stop the harm spreading while keeping evidence.
- Eradication: remove the attacker's access and tools, close the vulnerability they used, and reset compromised credentials.
- Recovery: restore systems from clean sources, return them to service in stages and watch closely for signs the attacker is back.
- Lessons learned: a blameless review within a couple of weeks, with actions, owners and dates.
NIST Revision 2 groups containment, eradication and recovery into one phase, because in real incidents you often loop between them as you discover more.
Containment choices
Containment always involves trade-offs. Isolating a server stops the attacker, but also stops the service. Acting too early can warn the attacker before you know how far they have spread; acting too late lets them do more damage. Decide in advance who can approve which action, and record each decision with the time and reason.
Common mistakes
| Mistake | Better practice |
|---|---|
| Wiping the infected machine immediately | Preserve evidence (memory and disk) first if the incident may need investigation |
| Resetting one password and declaring victory | Scope fully: other accounts, persistence and access methods |
| Restoring from backups that are also infected | Check restore points and scan before reconnecting |
| Skipping the lessons-learned meeting | Treat it as mandatory and track the actions |
| Working only in chat with no record | Keep a timestamped incident log from the start |
Tip: in exams, name the standard correctly (NIST SP 800-61) and show you know containment, eradication and recovery overlap in practice.
Real-world example: a compromised server at a small accountancy firm
A fictional accountancy firm with 25 staff has a short incident response plan. Preparation paid off: logs were centralised and backups tested. One Monday, the IT provider's monitoring detects a file server making outbound connections to an unknown address at night. Analysis shows a remote desktop account with a weak password had been used. For containment, the provider blocks the address, disables the account and removes the server from the network. Eradication means rebuilding the server and resetting all admin passwords; recovery restores files from Sunday's backup and monitors closely for a week. The lessons learned meeting leads to MFA on all remote access and closing remote desktop to the internet.
Practice
In which phase would you build contact lists and test backups?
Why might you delay containment briefly in some incidents?
What is the purpose of the lessons-learned phase?
Key takeaways
- NIST SP 800-61 is the standard reference for incident response.
- Classic phases: preparation, detection and analysis, containment, eradication, recovery, lessons learned.
- Revision 3 aligns IR with the NIST CSF 2.0 functions.
- Containment is a trade-off; agree approval rules in advance.
- Preserve evidence, scope fully and always hold a lessons-learned review.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.