Security - Process
Incident response
The organised process for dealing with and recovering from a security problem
What's it for?
Gives people a clear plan for containing, communicating and recovering from a security problem.
For example…
After an attack, the team isolates affected computers and restores clean backups
After ransomware is detected, incident response isolates affected machines, preserves evidence and starts recovery from clean backups.
Think of it like…
Hospital crash team: everyone knows their job so the emergency does not become chaos