The Incident Response Lifecycle

What you'll be able to do

By the end of this lesson you will be able to walk an incident through its full lifecycle and show where forensics fits.

• Describe the six phases of incident response and the tools used in each.
• Explain where forensic preservation and analysis fit into each phase.
• Map NIST's earlier four-phase cycle, which covers the same ground as the book's six phases, to the Cybersecurity Framework 2.0 functions in NIST's 2025 incident response model.

The Six Phases

The book describes incident response (IR) as the steps an organization takes when a cyber security breach or attack occurs. The objective is to detect, contain, eradicate and recover from incidents while minimizing damage. It follows a standard methodology in six phases.

1. Preparation. Having the tools, processes and trained people in place before anything happens: an incident response plan, training, detection mechanisms, and technologies such as intrusion detection systems (IDS), endpoint detection and response (EDR), security information and event management (SIEM) tools and response playbooks. The book notes that staying ready is hard because threats change constantly.

2. Identification. Detecting and confirming that an incident has actually happened, by monitoring, investigating alerts and analyzing anomalies. This can be very hard with advanced persistent threats (APTs), attackers who deliberately hide for long periods. Tools include SIEMs such as Splunk and ArcSight, threat-intelligence platforms, anomaly detection and network monitors such as Wireshark.

3. Containment. Limiting the spread and impact. The book distinguishes short-term containment (isolating affected systems) from long-term containment (removing the vulnerabilities that let the attacker in). Containment must be swift but careful, to avoid causing more damage or losing data. Tools include firewalls, network segmentation, malware-removal tools and endpoint isolation.

4. Eradication. Completely removing the root cause: eliminating malware, closing vulnerabilities and securing compromised accounts and systems. Malware may be deeply embedded or come in several variants, so this needs careful analysis. Tools include anti-malware, rootkit detection, patch management and vulnerability scanners.

5. Recovery. Restoring affected systems to normal operation with all security measures in place, and monitoring for any return of the attacker. The balance is between restoring service and staying secure. Tools include backup and recovery, system re-imaging and integrity verification before systems rejoin the network.

6. Lessons learned. A post-incident review that evaluates the response, identifies what went well and badly, and drives improvement. The book warns that this phase is sometimes overlooked but is crucial for future resilience.

Where Forensics Fits

Forensics is not a separate project that starts after the incident. It runs through every phase:

Real-World Example

Imagine (a fictional scenario) an engineering firm. Preparation: it has an IR plan, a SIEM collecting logs, and an external DFIR firm on call. Identification: on Tuesday the SIEM flags a sign-in to an engineer's account from an unusual country, followed by mass downloads from the project file share. Containment: the team disables the account, signs out all of its sessions, and blocks the attacker's address. Before changing anything else, the DFIR firm captures the engineer's laptop memory and collects the identity provider's sign-in logs. Eradication: analysis shows a phishing page captured the engineer's password and a one-time code; no malware was installed. The team resets the credentials and moves staff to phishing-resistant sign-in. Recovery: the file share is checked against its last known-good state and monitored closely for two weeks. Lessons learned: the review recommends phishing-resistant authentication for all staff and alerts for mass downloads, and records that the forensic timeline was available within 24 hours because logging had been prepared in advance.

From the Book to 2026

What the book teaches. Incident response follows six phases: preparation, identification, containment, eradication, recovery and lessons learned.

Why it made sense. This six-phase cycle is the model taught in SANS's widely used Incident Handler's Handbook (2012), and it remains a clear, practical way to organize a response. NIST's long-standing guide, SP 800-61 Revision 2 (2012), used an equivalent four-phase cycle: preparation; detection and analysis; containment, eradication and recovery; and post-incident activity.

What has changed. In April 2025 NIST replaced that guide with SP 800-61 Revision 3, which rebuilds incident response around the six functions of its Cybersecurity Framework (CSF) 2.0: Govern, Identify, Protect, Detect, Respond and Recover. NIST explains why: incidents are now frequent and damaging, recovery often takes weeks or months, and incident response must be part of an organization's whole cyber risk management rather than a separate activity for a separate team. Lessons learned should be shared as soon as they are identified, not saved until recovery ends. NIST maps the old phases to the new functions:

NIST also says that organizations should use whichever lifecycle model suits them best.

What to do now. Use the six phases to run an incident, and use NIST's CSF 2.0 view to make sure preparation, governance and continuous improvement are built into the organization's everyday risk management, not saved for after a crisis.

Watch: Incident Response (Security+ 4.8)

In this short lesson, Professor Messer walks through the incident response process. According to the published lesson notes, it covers preparation (including contact lists, an "incident go bag" of tools, documentation, baselines, file hashes and clean system images), detection and analysis, containment (including testing suspicious software in a sandbox), eradication, recovery and a post-incident meeting.

As you watch, notice:

• How the video's phases line up with the book's six phases.
• The preparation items that are really forensic readiness: baselines, file hashes and clean images.
• That the video cites NIST SP 800-61 Revision 2. As this lesson explains, NIST replaced it with Revision 3 in April 2025; the phases you see are still the classic way to run a response.

The video complements what you just read. The lesson is complete without it.

What Would You Do?

During containment of a malware outbreak, a technician proposes reformatting all twelve infected laptops at once "to be sure". No one has yet worked out how the malware arrived. What would you recommend? Decide, then compare with the model answer in the note below.

Knowledge Check

Key Takeaways

• Six phases: preparation, identification, containment (short-term and long-term), eradication, recovery and lessons learned.
• Forensics runs through every phase, starting with forensic readiness in preparation.
• Preserve before you wipe: containment and eradication must not destroy the evidence of how the attack happened.
• NIST SP 800-61r3 (2025) places incident response inside CSF 2.0 risk management: Govern, Identify, Protect, Detect, Respond, Recover.

Sources

• Dr. Tahseen Al-Doori — IT Forensics Essentials: Concepts, Tools, and the Practice of Digital Investigation, Chapter 3.2
• NIST — SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management (April 2025)
• SANS — Incident Handler's Handbook (Patrick Kral, 2012)
• NIST — SP 800-86: Guide to Integrating Forensic Techniques into Incident Response
• Professor Messer — Incident Response, CompTIA Security+ SY0-701 4.8 (lesson notes)