The six steps of incident response are preparation, identification, containment, eradication, recovery, and lessons learned. The sequence comes from NIST Special Publication 800-61, the federal standard that has guided cybersecurity response since its first release and remains the most widely adopted framework in both government and private industry.1Computer Security Resource Center. NIST SP 800-61 Rev. 3 Incident Response Recommendations and Considerations for Cybersecurity Risk Management Each phase has its own technical work and its own legal exposure, and knowing what belongs in each is what separates a controlled recovery from a compounding disaster.
A quick clarification before the walkthrough. NIST SP 800-61 Revision 2 actually groups the work into four phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity.2Computer Security Resource Center. NIST SP 800-61r3 The six-step version most training materials use splits the third phase into three distinct stages so teams get separate checklists for containment, root-cause removal, and system restoration. Same work, same order, more granular.
Step 1: Preparation
Everything you do before an alert fires determines how the next five steps go. Preparation means assembling the team, writing the playbook, and testing both until the response is reflexive rather than improvised.
Build the Response Team
A working team is more than IT. At minimum you need a technical lead who can triage network and endpoint alerts, a legal representative who understands notification deadlines and evidence preservation, a communications point person for internal and external messaging, and an executive sponsor with authority to shut systems down or approve emergency spending. Document each role, each backup, and each after-hours contact. Keep a printed copy in a physical binder, because a contact list on the file server is useless when the file server is encrypted by ransomware.
The team operates under a formal incident response policy that spells out who can declare an incident, who authorizes containment actions like isolating a server, and what severity tiers trigger executive escalation. Severity is typically calibrated against potential financial loss, regulatory exposure, and the sensitivity of the data involved. A defaced marketing page and a breach touching patient records do not sit at the same tier.
Run Tabletop Exercises
A plan that has never been tested is a guess. Tabletop exercises walk the team through a simulated breach in real time, testing decisions, handoffs, and communication without touching production. NIST SP 800-84 defines three exercise types: discussion-based tabletops, functional exercises where staff perform duties in a simulated environment, and full operational tests with quantifiable metrics.3Internal Revenue Service. Incident Response Test and Exercise Guidance Federal agencies handling sensitive tax data are required to run these annually, and that cadence is a reasonable floor for any organization. Findings should feed directly back into the response plan.
Set Up Legal Privilege Before You Need It
This is where many organizations create an expensive problem they only discover during litigation. If you want forensic findings protected by attorney-client privilege, outside counsel should retain and direct the forensic firm under an engagement tied to legal advice. Courts have rejected privilege claims when the forensic vendor’s work did not materially change after counsel got involved, or when the same vendor was already performing routine IT work under a pre-existing contract. The safer structure is a dual track: one track for business continuity and remediation run by IT, a separate track directed by counsel focused on legal exposure. Payment for the counsel-directed track should come from the legal budget, not the IT budget. Billing channel matters when privilege is challenged.
Coordinate With Your Cyber Insurer
If you carry cyber insurance, preparation is when you confirm the notification window and pre-approved vendor lists. Most policies require reporting within a specific timeframe often tied to the policy period. Late notification can void the claim, and a subsequent policy may also deny coverage because the event was discovered before that policy’s effective date. That leaves you uninsured from both directions. Keep the insurer’s claims hotline in the same offline binder as your team contact list.
Step 2: Identification
Identification is where a suspicious signal becomes a confirmed incident. The goal is to separate real threats from noise quickly enough to contain damage, but carefully enough to avoid burning resources on false alarms.
Responders pull from multiple data streams: system logs, firewall alerts, endpoint detection tools, email gateway flags, and user reports of unusual behavior. The signals they look for, called indicators of compromise, include unexpected outbound traffic to unfamiliar addresses, logins from unusual locations or hours, new administrator accounts nobody created, and unexpected changes to system files. No single alert tells the full story. Teams correlate multiple signals to determine whether they are looking at a configuration error, a known false positive, or genuine unauthorized activity. Threat intelligence feeds from an Information Sharing and Analysis Center can accelerate this by matching internal alerts against attack patterns observed at peer organizations.
Once unauthorized activity is confirmed, the team formally declares an incident at the severity level established during preparation. The declaration triggers the response plan and starts the documentation clock. Every action from this point forward should be timestamped and recorded, because those records will matter for regulatory reporting, insurance claims, and any litigation that follows.
Step 3: Containment
With the incident confirmed, the priority shifts to stopping the spread without destroying the evidence you will need later.
Short-Term Containment
The first actions are blunt and fast: isolate affected machines from the network, block known malicious IP addresses at the firewall, disable compromised user accounts, and revoke stolen credentials. For a single compromised workstation, that may mean pulling the Ethernet cable. For a broader compromise, it may mean segmenting entire network zones.
Speed matters, and so does restraint. Powering off a server destroys volatile data: running processes, active network connections, encryption keys, and malware that exists only in RAM. Forensic investigators follow an order of volatility when collecting evidence, capturing the most perishable data first — processor registers and cache, then memory, then temporary files, then disk contents.4United Nations Office on Drugs and Crime. Handling of Digital Evidence If your plan says to immediately power off a compromised machine, you are trading forensic evidence for speed. Sometimes that is the right call, but it should be a deliberate decision.
Long-Term Containment
After initial isolation, the team implements more sustainable controls that let the business keep operating while affected systems stay cordoned off. Temporary firewall rules, additional monitoring points, clean replacement systems for critical functions, or restricting VPN access to verified devices all fall in this category. The point is to buy the eradication team time to work without pressure to restore compromised systems prematurely.
Every action must be documented in enough detail to maintain a chain of custody: who did what, when, on which system, and why. Keep business-track containment records separate from any counsel-directed investigation records if you set up the privilege structure recommended in preparation.
Step 4: Eradication
Containment stops the spread. Eradication removes the cause. The technical team deletes malicious files, terminates unauthorized accounts and scheduled tasks the attacker created, and identifies the specific vulnerability that allowed the breach. That vulnerability might be an unpatched application, a misconfigured firewall rule, a stolen credential that was never rotated, or a phishing email that bypassed filtering. Removing the malware without closing the door it came through invites a repeat visit, and second compromises tend to be faster because the attacker already knows the network layout.
Once the root cause is identified, the team patches all affected systems, rotates compromised credentials across the environment, and hardens configurations against the specific weaknesses the attacker exploited. This is painstaking work and it is where most organizations feel the financial impact most acutely. Specialized forensic consultants command significant hourly rates, and a complex engagement can run for weeks. Cutting eradication short to save money almost always costs more later, because recurring infections multiply remediation costs and extend business disruption.
Step 5: Recovery
Recovery brings systems back to normal operations using clean, verified data. The pressure to rush this phase is intense, because the business has been degraded since containment began. Rushing is exactly how organizations reintroduce the threat they just spent weeks removing.
Restoration From Verified Backups
The team must identify backups created before the initial point of compromise, not before the date the breach was discovered. Those two dates are often weeks or months apart. Each backup should be scanned for known indicators of compromise before restoration. Systems come back online in priority order based on business criticality, with revenue-generating and customer-facing services typically restored first.
Every restored system gets validated in a controlled environment before it touches the production network. That means running vulnerability scans against the operating system, web applications, and databases to confirm no known weaknesses remain. Authenticated scans are preferable because they can check configurations unauthenticated scans miss. Any restored system that cannot pass a clean scan does not go back into production.
Heightened Monitoring
For a defined period after restoration, the team runs enhanced monitoring to catch reinfection or attacker persistence. File integrity monitoring on critical systems, increased logging frequency, and close attention to any traffic patterns resembling the original compromise all belong here. Two to four weeks of elevated monitoring is common for moderate incidents, though the right duration depends on the sophistication of the attack and the thoroughness of eradication.
Step 6: Lessons Learned
The final step turns a painful event into an organizational improvement. Skip it and you will likely repeat the same mistakes under worse conditions.
Within a few weeks of closing the incident, the full response team meets to walk through the timeline from first alert to final restoration. The discussion should be candid and blame-free. How long did detection take? Where did handoffs between team members break down? Did the communication plan reach the right people at the right time? Were the severity levels calibrated correctly?
The output is a formal lessons-learned report documenting the incident timeline, technical root cause, response actions, financial impact (downtime, forensic fees, legal expenses, regulatory penalties), and specific recommendations for improving the plan. That report feeds directly into playbook updates and the next round of tabletop exercises.
Incident records are not optional paperwork. Retention obligations vary by regulatory framework: organizations subject to federal health privacy laws must retain relevant records for at least six years, and financial institutions under federal banking regulations face similar six-year obligations. Any organization that may face litigation related to the breach should implement a legal hold ensuring that all logs, forensic images, communications, and reports are preserved until counsel confirms the hold can be lifted. Destroying records subject to a legal hold, even unintentionally through routine data purging, can result in court sanctions more damaging than the underlying claim.
Notification Deadlines Running in Parallel
The six steps cover the technical work, but legal notification obligations run alongside them with their own clocks. Missing a notification window can cost more than the breach itself.
State Breach Notification
All 50 states, the District of Columbia, and U.S. territories have enacted breach notification laws requiring organizations to notify affected individuals when personal information is compromised.5National Conference of State Legislatures. Security Breach Notification Laws What qualifies as personal information, how quickly you must notify, whether encrypted data is exempt, and whether the state attorney general must be separately notified all vary by jurisdiction. Deadlines generally range from 30 to 60 days after discovery, though some states use a “without unreasonable delay” standard with no fixed number. If the breach affects residents in multiple states, you are subject to each state’s law simultaneously. Many organizations default to the shortest applicable deadline to simplify compliance.
HIPAA Breach Notification
Organizations covered by HIPAA must notify affected individuals no later than 60 days after discovering a breach of unsecured protected health information.6U.S. Department of Health and Human Services. Breach Notification Rule The notice must describe what happened, what information was involved, what steps individuals should take to protect themselves, and what the organization is doing to investigate and prevent recurrence. Breaches affecting 500 or more individuals also require notification to HHS and prominent media outlets serving the affected area. Civil penalties are adjusted annually for inflation and can reach over $70,000 per violation, with annual caps exceeding $2 million for the most serious category of willful neglect.
SEC Disclosure for Public Companies
Public companies must file a Form 8-K under Item 1.05 within four business days of determining that a cybersecurity incident is material.7U.S. Securities and Exchange Commission. Form 8-K The Attorney General can authorize a delay of up to 30 days, and in extraordinary circumstances up to 120 days total, if disclosure would pose a substantial risk to national security or public safety. The four-day clock runs from the materiality determination, not the date of the breach, but the SEC has stated that companies cannot unreasonably delay making that determination.8U.S. Securities and Exchange Commission. Disclosure of Cybersecurity Incidents Determined To Be Material and Other Cybersecurity Incidents
Critical Infrastructure Reporting
The Cyber Incident Reporting for Critical Infrastructure Act of 2022 directs CISA to create mandatory reporting rules for covered entities that experience significant cyber incidents or make ransomware payments.9Cybersecurity and Infrastructure Security Agency. Cyber Incident Reporting for Critical Infrastructure Act of 2022 The final rule is expected in mid-2026.10Reginfo.gov. View Rule – CIRCIA Final Rule Until it takes effect, reporting to CISA is voluntary but encouraged, and organizations can report around the clock through CISA’s online portal, email, or phone.
Ransomware Payments and Sanctions Risk
Organizations considering a ransomware payment face a legal risk many response plans overlook. The Treasury Department’s Office of Foreign Assets Control has warned that payments to sanctioned entities, including certain ransomware operators and the countries harboring them, may violate U.S. sanctions laws regardless of whether the payer knew the recipient was sanctioned.11U.S. Department of the Treasury. Cyber-Related Sanctions Before any payment is made, counsel should screen the demand against current OFAC sanctions lists. Paying first and checking later can create a federal enforcement problem on top of the breach.