Incident management is the organized approach to addressing and managing the aftermath of a security breach or cyber attack. Its primary goal is to minimize the damage, restore normal operations as quickly as possible, and learn from the incident to improve future defenses. A well-defined incident response plan is critical for effective crisis management. The National Institute of Standards and Technology (NIST) Special Publication 800-61, “Computer Security Incident Handling Guide,” provides a widely adopted framework for incident response, outlining six key phases [7]:
Preparation: #
This foundational phase involves establishing the necessary tools, training, and procedures before an incident occurs. Key activities include:
Keep reading with a free Eristotle account.
Every document across our Bodies of Knowledge is free to read once you are signed in. No payment, no tier.
