🧯
Incident Response (IR)
Security
Coordinated process for detecting, containing, and remediating incidents.
Definition
IR includes monitoring, triage, containment, eradication, recovery, forensics, communication, and post-incident improvements.
In plain English
Coordinated process for detecting, containing, and remediating incidents.
Why this matters
Why it matters: Effective IR reduces dwell time, limits data exfiltration, and supports legal and regulatory obligations.
Example
Example: Containment of compromised credentials, key rotation, and disclosure workflows.