Incident Response Fundamentals and NIST SP 800-61 Lifecycle

What Is Incident Response?

An incident in cybersecurity is any event that actually or potentially threatens the confidentiality, integrity, or availability of information systems or the data they hold. Incident response (IR) is the organized approach an organization uses to prepare for, detect, contain, and recover from those events. Without a structured process, security teams risk missing critical steps, destroying evidence, or allowing an attacker to persist inside the network long after the initial breach is discovered.

The most widely referenced framework for incident response in the United States is NIST Special Publication 800-61 Revision 2, titled Computer Security Incident Handling Guide, published by the National Institute of Standards and Technology. It is freely available as a PDF and is referenced by federal agencies, private enterprises, and certification bodies including CompTIA and ISC2. Security+ and CySA+ exam objectives explicitly reference this lifecycle.

The Four Phases of NIST SP 800-61

NIST SP 800-61 Rev. 2 organizes incident response into four high-level phases that form a continuous cycle, not a straight line. Lessons learned from one incident feed directly back into preparation for the next.

Phase 1 — Preparation

Preparation is the foundation of every other phase. During preparation, organizations build the capability to respond before an incident occurs. Key activities include:

• Establishing and training an Incident Response Team (IRT) with clearly defined roles.
• Creating and distributing an Incident Response Plan (IRP) that documents procedures, escalation paths, and communication channels.
• Deploying tools such as security information and event management (SIEM) systems, intrusion detection systems (IDS), and endpoint detection and response (EDR) platforms.
• Maintaining jump bags or forensic kits — tested hardware and software used by responders when they arrive at an affected system.
• Establishing relationships with legal counsel, law enforcement contacts, and external IR vendors in advance.

Strong preparation reduces dwell time — the period between an attacker's entry and detection — and limits overall damage.

Phase 2 — Detection and Analysis

This phase begins when a potential incident is identified. Detection sources include alerts from SIEM tools, reports from end users, threat intelligence feeds, and automated endpoint alerts. Not every alert is a real incident; analysts must triage events to separate genuine threats from false positives.

Analysis involves:

• Correlating indicators of compromise (IOCs) such as suspicious IP addresses, unusual process execution, or abnormal data transfers.
• Prioritizing the incident based on its functional impact (how much business capability is lost), informational impact (what data may be exposed), and recoverability effort.
• Documenting all findings with timestamps in an incident log. This documentation protects the organization legally and supports the post-incident review.

NIST emphasizes that analysts should use a precursor (a sign an attack may happen) versus indicator (a sign an attack is happening or has happened) distinction during this phase.

Phase 3 — Containment, Eradication, and Recovery

NIST groups these three steps into one phase because they overlap in practice.

Containment stops the spread of the incident. Short-term containment might mean isolating an infected host from the network immediately. Long-term containment might involve applying temporary patches or changing firewall rules while a permanent fix is prepared. Crucially, responders must preserve forensic evidence before containment changes alter the system state — memory captures and disk images should be taken first where possible.

Eradication removes the root cause. This includes deleting malware, closing exploited vulnerabilities, removing unauthorized user accounts, and patching the affected systems. Simply restoring from backup without fixing the underlying vulnerability will result in re-infection.

Recovery returns systems to normal operation. Steps include restoring from clean backups, rebuilding compromised systems, and closely monitoring restored systems for signs that the threat persists. Recovery is declared complete only when the organization has reasonable confidence the threat has been removed.

Phase 4 — Post-Incident Activity

After systems are stable, the team conducts a post-incident review (sometimes called an after-action review or lessons-learned meeting). This meeting should occur while details are fresh — NIST recommends within a few days of the incident's closure. The review identifies:

• What happened, when, and how.
• How effectively the IRP was followed.
• What could have been detected sooner.
• What changes to policies, tools, or training are needed.

Findings feed directly back into Phase 1, strengthening preparation for the future.

NIST 800-61 vs. SANS PICERL

The SANS Institute describes incident response using a six-step mnemonic: Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned (PICERL). The concepts closely match NIST 800-61. NIST's "Detection and Analysis" maps to SANS's "Identification," and NIST's "Post-Incident Activity" maps to "Lessons Learned." The primary difference is structural: SANS separates each step explicitly, while NIST consolidates containment, eradication, and recovery into one phase. Both frameworks are accepted references for certification exams.

Safety and Professional Responsibility

Incident response work carries professional and legal responsibilities. Responders must handle evidence in a way that preserves chain of custody — a documented record of who accessed evidence, when, and how. Improper handling can make evidence inadmissible in legal proceedings. Always work under the direction of your organization's legal team when law enforcement involvement is possible. Never access systems or data outside the scope authorized by management. Follow your organization's acceptable-use and authorization policies at all times.