Incident response: the steps, explained

NIST and SANS, side by side

NIST and SANS divide the same work differently: NIST groups containment, eradication and recovery into one phase, because in practice they overlap and repeat.

NIST published Revision 3 of SP 800-61 in April 2025. It keeps the same activities but files them under the six functions of the NIST Cybersecurity Framework 2.0: govern, identify, protect, detect, respond and recover. The point it makes is that incident response is part of running security all year, not a separate plan in a drawer. Sources: NIST SP 800-61 Rev. 2, Rev. 3.

1. Preparation

Preparation decides how the rest goes, because nobody writes a good plan during an attack.

• A written plan: who leads, who decides, who talks to customers, regulators and police.
• Contact details kept somewhere that still works when email and the network do not.
• Logs and EDR already collecting, since nobody can investigate what was never recorded.
• Backups that follow the 3-2-1 rule, with one copy offline, and a tested restore.
• A tabletop exercise: walk the team through a made-up incident once or twice a year.

2. Detection and analysis

Detection is finding out that something is wrong; analysis is finding out how wrong.

Alerts come from EDR, antivirus, unusual logins, users reporting a strange email, or worst of all, a ransom note. Analysts confirm the incident is real, then establish scope: which machines and accounts, since when, and what data. Every action and time is written down from this point on.

3. Containment

Containment stops the damage spreading while the investigation continues.

Short-term containment isolates machines and disables compromised accounts; long-term containment might rebuild a server in a clean network. Speed matters, but so does evidence: isolating a machine keeps its memory intact, where switching it off would not.

4. Eradication

Eradication removes everything the attacker left behind and closes the door they came in through.

That means the malware, any extra accounts or scheduled tasks they created, and the original weakness: the unpatched server, the password without multi-factor authentication. Malware analysis tells responders what to look for.

5. Recovery

Recovery brings systems back into use, carefully, from known-good sources.

Systems are restored from clean backups or rebuilt, passwords are reset, and monitoring is turned up for weeks, because attackers who kept a foothold come back.

6. Lessons learned

The review turns one bad week into lasting improvements.

Within about two weeks, the team agrees on a timeline, what worked, what did not, and a short list of changes with owners and dates. Blame-free reviews get more honest answers.

The first hour: a checklist

1. Do not panic, and do not switch affected machines off. Disconnect them from the network.
2. Call the incident lead in your plan, your IT provider or your cyber insurer's hotline.
3. Start a written log: what you saw, what you did, and when, to the minute.
4. Use a separate, clean device and a separate channel to talk, in case email is compromised.
5. Preserve evidence: do not delete suspicious emails or files, and do not run cleaning tools yet.
6. Reset passwords for affected accounts from a clean device, and check for new forwarding rules on email.
7. Do not contact the attackers or pay anything before getting advice.
8. Check your legal duties: under the GDPR, for example, a personal data breach must normally be reported to the regulator within 72 hours of becoming aware of it.

For the attack this checklist most often meets, see how ransomware works.