Incident response
IR · incident management · security incident response · cyber crisis management · incident response plan · IRP
The organised set of actions taken to detect an attack, limit the damage, drive the attacker out, restore operations and learn the lessons.
In practice
The classic cycle has six steps: preparation, detection, containment, eradication, recovery, lessons learned. Published in April 2025, revision 3 of NIST SP 800-61 aligns it with the NIST CSF 2.0: Govern, Identify and Protect cover preparation; Detect, Respond and Recover make up the response itself; continuous improvement feeds every function. In France, the government’s Cybermalveillance.gouv.fr platform and 17Cyber service guide victims, CERT-FR steps in for central government and critical operators, and the CNIL (the data protection authority) must be notified within 72 hours of a personal data breach. File a police complaint too: under the French Insurance Code, cyber cover only pays out if a complaint is filed within 72 hours.
Fictional case: one Monday at 8 a.m., an accounting firm’s screens display a ransom note. The manager has the computers unplugged from the network without switching them off, calls the IT provider, notifies the CNIL because client data is affected and files a complaint. He then restores from an offline backup, after changing every password.
How to protect yourself
- Write a short response plan: who decides, who to call, where the backups are.
- Keep emergency contacts outside the information system, on paper for instance: IT provider, insurer, Cybermalveillance.gouv.fr, CERT-FR.
- Run at least one crisis exercise a year, with senior management taking part.
