Security · Website glossary

Incident response

Quick answer · What is Incident response?

A coordinated process for assessing, containing, investigating, and recovering from a suspected security incident.

IN PRACTICE

Incident response: an example

A team records the observed problem, preserves relevant evidence, limits exposure, and works through a recovery plan.

KEEP IN MIND

Deleting evidence or making many unrecorded changes can make investigation harder; define ownership and record actions.

Put the idea to work

Frequently asked questions

What is a practical example of Incident response?

A team records the observed problem, preserves relevant evidence, limits exposure, and works through a recovery plan.

Why should incident actions and evidence be recorded?

Deleting evidence or making many unrecorded changes can make investigation harder; define ownership and record actions.

Which concepts should I read alongside Incident response?

Monitoring: The ongoing collection and evaluation of signals used to understand a system's condition and detect problems.
Backup: A recoverable copy of data or system state kept to support restoration after loss or unwanted change.