The incident response lifecycle (NIST SP 800-61)

Why a plan

An incident is an event that harms, or threatens to harm, the confidentiality, integrity or availability of systems or data, like ransomware, a stolen admin account or a data leak. In the first hours, people panic: someone switches servers off and destroys evidence, someone emails the attacker, nobody tells the regulator in time. A written, practised plan prevents this.

The four phases (NIST SP 800-61 Rev. 2)

NIST (the US National Institute of Standards and Technology) published SP 800-61 Rev. 2, the "Computer Security Incident Handling Guide". Its lifecycle is the most widely taught model:

The phases loop: lessons learned feed back into preparation, and detection and containment often go back and forth as you find more affected systems.

In April 2025 NIST published SP 800-61 Rev. 3, "Incident Response Recommendations and Considerations for Cybersecurity Risk Management". It maps incident response onto the six functions of the NIST Cybersecurity Framework 2.0: Govern, Identify, Protect, Detect, Respond and Recover. The four-phase model above is still the common language in SOCs and exams, so learn both. A similar six-step model from SANS is called PICERL: Preparation, Identification, Containment, Eradication, Recovery, Lessons learned.

Containment choices

Containment means stopping the damage from spreading. It is a decision, not a reflex:

• Short-term: isolate the laptop from the network using EDR, block an IP at the firewall, disable a compromised account, reset its sessions.
• Long-term: rebuild servers, move services to clean systems, add temporary extra monitoring.
• Trade-off: cutting off a server stops the attacker but also stops the business. Agree in advance who can make that call.

Evidence

• Preserve before you clean: collect memory and disk images, or at least key logs, before wiping a machine.
• Order of volatility: collect the most short-lived data first (memory, running processes, network connections) and the most lasting last (disk, backups).
• Chain of custody: a record of who collected each piece of evidence, when, and who has handled it since. Needed if the case goes to court or a regulator.
• Hashes: hash evidence files when collected, so you can later prove they were not changed.

Communication and reporting

Incidents involve more than the SOC: managers, legal, PR, sometimes customers and regulators. In India, CERT-In's 2022 directions require listed types of cyber incidents to be reported to CERT-In within 6 hours of noticing them, and the DPDP Act adds duties for personal data breaches (Module 8). Your plan must include who reports, to whom, and how.

Common mistakes

• Wiping and rebuilding at once, destroying evidence of how the attacker got in, so they come back the same way.
• Containing one machine while the attacker still has a stolen admin password.
• Restoring from backups that are themselves infected. Check backups before restoring.
• Skipping the lessons-learned meeting because everyone is tired.