What is an incident response plan?
D4 · Operations · CompTIA Security+ SY0-701An incident response plan (IRP) is a documented, structured approach for handling security incidents — from preparation through recovery.
The NIST incident response lifecycle has 4 phases:
1️⃣ Preparation — policies, tools, team training
2️⃣ Detection & Analysis — identify and scope the incident
3️⃣ Containment, Eradication & Recovery — stop spread, remove threat, restore systems
4️⃣ Post-Incident Activity — lessons learned, improve defenses
The NIST incident response lifecycle has 4 phases:
1️⃣ Preparation — policies, tools, team training
2️⃣ Detection & Analysis — identify and scope the incident
3️⃣ Containment, Eradication & Recovery — stop spread, remove threat, restore systems
4️⃣ Post-Incident Activity — lessons learned, improve defenses
Know the NIST 4-phase IR lifecycle. SANS uses a 6-phase model: Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned. "Lessons learned" is always the last phase. The incident response team (CSIRT/SOC) executes the plan.