thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Foundational

Incident Response (IR)

The organized approach to preparing for, detecting, containing, eradicating and recovering from security incidents.

Definition

IR minimizes damage, recovery time and cost while preserving evidence and learning from incidents. It follows a documented plan and lifecycle such as NIST SP 800-61 or SANS PICERL and involves technical, legal, communications and management stakeholders.

Example

Activating the IR plan after detecting ransomware on a domain controller.

Exam tip

Follow the lifecycle order on exams; containment comes before eradication.

Related terms