What is Incident response? Definition and explanations
Incident response is the organised process that governs handling a compromise, from report to return to normal. The classic NIST framework (SP 800-61 Rev. 2) describes four phases: preparation, detection and analysis, containment plus eradication and recovery, and finally lessons learned; Revision 3 (2025) reorganises them around the Cybersecurity Framework 2.0 functions. What makes the difference in a real situation is roles, access and contacts defined in advance.
In one sentence
Incident response governs the handling of a compromise, from report to return to normal.