Incident response

The discipline dates from the Morris worm of November 1988, after which DARPA funded the CERT Coordination Center at Carnegie Mellon; FIRST, the global forum of response teams, followed in 1990. For two decades the dominant process model has been the NIST SP 800-61 lifecycle, whose Revision 2 (2012) describes four phases: preparation; detection and analysis; containment, eradication and recovery; and post-incident activity. Revision 3 (April 2025) retired that lifecycle and instead maps incident response onto the six Functions of the NIST Cybersecurity Framework 2.0 (Govern, Identify, Protect, Detect, Respond, Recover), treating preparation and improvement as continuous rather than as phases. The SANS six-step model (preparation, identification, containment, eradication, recovery, lessons learned) splits the same work differently. ISO/IEC 27035-1:2023 frames it as plan and prepare, detect and report, assess and decide, respond, and learn lessons.

NIST SP 800-61 Revision 3, finalised in April 2025, withdrew Revision 2 and re-expressed incident response through the six functions of the Cybersecurity Framework 2.0. Govern, Identify and Protect cover the preparation that makes response possible; Detect covers finding and analysing adverse events; Respond covers incident management, analysis, reporting and communication, and mitigation; and Recover covers restoration and recovery communication. The change reflects the view that incident response is an organisation-wide capability tied to risk management rather than a separate team's process, and that lessons learned should feed improvement continuously, not only at the end.

Technically, detection and analysis rely on correlated telemetry from SIEM, EDR, identity provider and network logs, triage against a severity scheme, and scoping by searching for indicators of compromise and attacker techniques across the estate. Evidence is collected in order of volatility, as described in RFC 3227 (memory, network state and running processes before disk), with hashes and a chain of custody if legal action is possible. Containment choices are trade-offs: isolating a host with EDR keeps it available for forensics, while pulling the power destroys memory; resetting a compromised account before understanding the attacker's persistence can alert them and trigger destructive action. Eradication must remove every foothold, including scheduled tasks, web shells, new accounts, OAuth grants and, after domain compromise, the krbtgt key, which is reset twice.

Incident response is distinct from its neighbours. Crisis management is the leadership layer that makes business decisions around the incident, business continuity keeps operations running meanwhile, and disaster recovery restores technology after large-scale loss. Incident reporting to authorities under NIS2, GDPR or DORA is one of the obligations handled within incident response. In practice many Danish organisations rely on an external incident response retainer, whose activation procedure, contact details and pre-agreed access must be part of the preparation.