Incident response
Incident response is the coordinated work of investigating and managing a cybersecurity incident, limiting its impact, removing the causes of compromise, and restoring affected operations.
More than stopping the immediate activity
Disabling a compromised account may help contain an incident. Responders still need to understand what happened, find other affected access, address the cause, and restore normal work. Containment is one part of that effort.
NIST SP 800-61 Revision 3 places incident response within ongoing cybersecurity risk management. Preparation supports detection, response, and recovery; lessons from incidents feed back into improvements. The work is not a rigid sequence that every team completes once.
Keep the facts and decisions connected
A report can arrive before anyone knows whether a compromise occurred. Record what was reported, what has been confirmed, and what remains unresolved. A threatening email claiming stolen data deserves investigation, but the claim alone does not establish theft. The extortion-claim article explains that first handoff.
As the response develops, technical teams, service owners, and other responsible functions need a shared understanding of impact and priorities. Preserve relevant evidence and record response changes so investigators can tell their own actions apart from the attacker’s.
Recovery needs its own checks. Restoring a service is useful; restoring it while unwanted access remains would leave the problem unfinished. The identity containment review walks through accounts, sessions, and other access that may need separate attention.