Glossary 🚨 Incident Response

Incident Response

Containment

Stopping an incident from spreading, for example by isolating a device or disabling a compromised account.

Why this matters

A simple written plan, with who to call and what to do first, can reduce confusion, downtime, and cost when an incident happens.

More in Incident Response

Incident triageQuickly assessing an alert or report to decide whether it is real, how serious it is, and who handles it.InvestigationWorking out what happened, how the attacker got in, and which systems and data were affected.EradicationRemoving the cause of the incident, such as malware, attacker access, or the exploited weakness.RecoverySafely restoring affected systems and data to normal operation and watching for signs of a repeat.ForensicsCarefully collecting and preserving digital evidence so events can be reconstructed and, if needed, used legally.PlaybooksStep-by-step guides for handling specific incident types, such as phishing, ransomware, or a lost laptop.Tabletop exercisesDiscussion-based practice sessions where a team walks through a pretend incident to test the plan.

Want help with incident response?

Tell me what you have and I'll tell you which few things actually matter for you.

Get in touchSee what I offer