What are the phases of incident response?
The best-known model has six: preparation, identification, containment, eradication, recovery and lessons learned, from the SANS incident handler's handbook. NIST's earlier guide, SP 800-61 Revision 2, grouped the same work into four phases. In April 2025, NIST replaced it with SP 800-61 Revision 3, which ties incident response to the six functions of its Cybersecurity Framework 2.0: govern, identify, protect, detect, respond and recover. All of them carry the same message: most of the work happens before the incident, in preparation, and after it, in improvement. For a small company the practical order is simple: notice, limit the damage, remove the cause, get back to work safely, and change whatever let it happen. Writing that sequence down for your own systems is the most useful first step.