Incident Response Plan: 6 Phases Every Organization Must Follow

An incident response plan is a documented, step-by-step framework that tells your security team exactly what to do when a cyberattack or data breach occurs. It defines six phases – Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned – along with clear roles, escalation paths, and response timelines to minimize damage.

• Key Takeaway 1: The NIST incident response process has six phases: Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned.
• Key Takeaway 2: IBM’s 2023 Cost of a Data Breach Report found the average breach takes 277 days to identify and contain without a strong IR program.
• Key Takeaway 3: A playbook is not the same as a plan. Your incident response plan is the strategy; playbooks are the tactical scripts for specific attack types.
• Key Takeaway 4: India-specific incidents, including the November 2022 AIIMS Delhi ransomware attack, show that even critical infrastructure operates without tested IR plans.
• Key Takeaway 5: Incident response skills are among the most demanded capabilities in Indian SOC hiring right now, especially post-2022.

Without a tested incident response plan, organizations lose days just figuring out who is in charge. IBM’s 2023 Cost of a Data Breach Report found organizations with IR teams and regularly tested plans saved an average of $1.49 million per breach compared to those with no plan in place.

The 6 Phases of an Incident Response Plan (NIST Framework)

NIST Special Publication 800-61 Rev. 2 is the gold standard reference for building an incident response process. It breaks the cycle into six phases, and every phase feeds directly into the next. Skipping one does not save time. It costs you in the recovery phase.

Here is how the six phases of an incident response plan work in practice, walked through the lens of a ransomware attack hitting a mid-sized Indian IT services firm.

Phase 1: Preparation

This is everything you do before an incident happens. It includes building your incident response team (CSIRT), writing playbooks, deploying logging and monitoring tools, running tabletop exercises, and defining escalation paths. If you have not done this work, every other phase of the incident response plan falls apart under pressure.

For our hypothetical IT firm, preparation means having endpoint detection deployed, log collection configured (more on why logs matter in our guide to what logs are in cybersecurity), and a contact list that includes legal, PR, and senior leadership, not just the security team.

Phase 2: Identification

Something triggers an alert. Maybe it is an EDR flag, a user reporting encrypted files, or a spike in outbound traffic at 2 AM. Identification is the process of confirming whether that signal is a real incident or a false positive, classifying its severity, and logging the initial details.

This is where your SOC Tier 1 and Tier 2 analysts earn their keep. Tier 1 triages the alert. Tier 2 investigates and confirms. Speed here directly affects containment time.

Phase 3: Containment

Once confirmed, you stop the bleeding. Short-term containment might mean isolating an infected workstation from the network. Long-term containment means patching the vulnerability that let the attacker in, resetting credentials, and blocking C2 (command and control) IPs at the firewall.

In the AIIMS Delhi incident of November 2022, delayed containment allowed ransomware to spread across multiple servers. The hospital patient management system stayed offline for weeks. That is what uncontained incidents cost in the real world.

Phase 4: Eradication

Containment stops the spread. Eradication removes the threat entirely. This means deleting malware, closing backdoors, removing rogue user accounts the attacker created, and confirming no persistence mechanisms remain. Rushing this phase is how organizations get re-infected within days.

Phase 5: Recovery

Systems come back online, carefully and in a controlled sequence. You restore from clean backups, monitor closely for re-infection, and validate that business operations are functioning normally. Recovery is not done when systems are back up. It is done when you are confident the threat is gone and systems are verified clean.

Phase 6: Lessons Learned

Within two weeks of the incident, your team holds a post-incident review. What happened? What worked? What failed? What needs to change in the incident response plan, the playbooks, or the tooling? This phase is what turns a painful incident into an organizational capability. Teams that skip it repeat the same mistakes.

NIST vs SANS Incident Response Frameworks, IR Plan vs DR vs BCP

People often ask whether to follow NIST or SANS for their incident response plan. The honest answer is that they are nearly identical in substance, with slightly different phase naming. SANS uses a six-phase model called PICERL: Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned. NIST SP 800-61 uses four high-level phases but expands them in practice to the same six steps. For most teams, the label matters less than actually following the process consistently.

Incident Response Plan vs Disaster Recovery vs Business Continuity

These three get confused constantly, so here is the distinction. An incident response plan covers the security response to a cyberattack. A disaster recovery (DR) plan covers restoring IT systems after any major failure, including natural disasters. A business continuity plan (BCP) covers keeping the whole organization operational during and after a disruption. They overlap, but they are not the same document.

Framework	Focus	Primary Owner	Triggered By	Typical Response Window
Incident Response Plan	Cyber threat response	CISO / SOC	Security incident	Minutes to hours (P1: under 1 hour)
Disaster Recovery Plan	IT system restoration	IT Operations	Any major system failure	Hours to days (RTO defined per system)
Business Continuity Plan	Organizational continuity	Senior Management	Any business disruption	Days to weeks
NIST SP 800-61	IR process standard	Security Team	Guidance framework	Ongoing / reference document

What Is an Incident Response Playbook?

An IR playbook is a specific, step-by-step response script for a defined attack scenario. Your incident response plan is the overarching strategy. Playbooks are the operational checklists that sit underneath it. You would have separate playbooks for ransomware, phishing, DDoS, insider threats, and data exfiltration, each with specific detection steps, containment actions, escalation triggers, and communication templates.

A good ransomware playbook, for example, tells the analyst exactly which systems to isolate first, which stakeholders to notify within the first 30 minutes, what forensic evidence to preserve before wiping, and what the regulatory notification timeline is under India’s Digital Personal Data Protection (DPDP) Act 2023, which requires breach notification to the Data Protection Board within a prescribed timeframe.

How to Create an Incident Response Plan: A Starter Template

Creating an incident response plan from scratch does not require a massive budget. It requires structured thinking and the right inputs. Here is the core structure every plan needs:

1. Policy Statement: Why this plan exists and who it applies to.
2. Scope and Objectives: What systems, incidents, and teams are covered.
3. Incident Response Team (CSIRT) Roster: Names, roles, and contact details.
4. Incident Classification Matrix: Severity levels (P1 through P4) with response SLAs.
5. Phase-by-Phase Response Procedures: The six NIST phases with specific actions.
6. Communication Plan: Internal escalation paths and external notification requirements.
7. Playbook Library: Scenario-specific response scripts.
8. Testing and Review Schedule: Tabletop exercises at minimum twice a year.

If you are working toward a career in incident response, certifications like GCIH (GIAC Certified Incident Handler) and ECIH (EC-Council Certified Incident Handler) are the recognized credentials in the field. Both are increasingly listed in Indian SOC job postings from firms like Infosys, TCS Security, and HCL Cybersecurity.

Who Should Be on Your Incident Response Team

The IR team, formally called a CSIRT (Computer Security Incident Response Team), is not just security analysts. A real incident touches legal liability, customer communications, regulatory reporting, and sometimes physical security. Your incident response plan needs representation from all of those areas.

Core CSIRT Roles

• IR Lead / Incident Commander: Owns the response. Makes containment and escalation calls. Usually a senior SOC analyst or CISO delegate.
• SOC Analysts (Tier 1, 2, 3): Handle detection, triage, deep investigation, and threat hunting. See our breakdown of SOC analyst tier levels explained for how these roles divide the work.
• Forensic Analyst: Preserves and analyzes evidence. Critical if legal action follows.
• Legal Counsel: Manages liability, regulatory notifications, and law enforcement interaction.
• Communications / PR: Handles customer and media communications during a breach.
• IT Operations: Executes containment actions like network isolation and system restoration.
• Business Stakeholders: Senior leaders from affected business units who can authorize downtime decisions.

Smaller organizations often cannot staff all of these roles internally. That is where a managed Security Operations Centre becomes critical, providing the detection capability and IR expertise that a small internal team simply cannot maintain alone.

Incident Response Skills Are in High Demand in India

The November 2022 AIIMS Delhi ransomware attack, the 2022 Air India data breach affecting 4.5 million passengers, and repeated incidents targeting Indian banking infrastructure have pushed IR skills to the top of SOC hiring requirements. According to the NASSCOM-DSCI Cybersecurity Task Force Report 2023, India faces a shortfall of over 790,000 cybersecurity professionals, with incident response and threat analysis roles among the hardest to fill.

If you are building toward an IR career, the 3.0 University SOC Analyst certification course covers detection, triage, log analysis, and the foundational skills that every incident responder needs before specializing in GCIH or ECIH-level work.

The First Step After a Breach

The most common mistake after discovering a breach is jumping straight to cleanup. That destroys forensic evidence. The correct first step is containment without evidence destruction: isolate affected systems from the network, preserve memory dumps and logs, and document everything you observe before touching anything. Only then do you begin eradication.

According to IBM’s 2023 Cost of a Data Breach Report, organizations that contained a breach in under 200 days saved an average of $1.02 million compared to those that took longer. Speed matters, but only disciplined speed that follows the incident response plan process.

Frequently Asked Questions

What are the 6 phases of incident response?

The six phases, as defined by NIST SP 800-61, are: Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned. Each phase has specific actions, owners, and outputs. SANS uses the same six phases under the PICERL model. Both frameworks lead to the same practical incident response process when implemented correctly.

How do you create an incident response plan?

Start by defining scope, assembling your CSIRT, and building an incident classification matrix. Then document phase-by-phase response procedures aligned to NIST SP 800-61, write playbooks for your top five threat scenarios, define communication and escalation paths, and schedule tabletop exercises at least twice a year to test and improve the plan.

What is an incident response playbook?

An IR playbook is a step-by-step response script for a specific attack type, such as ransomware, phishing, or DDoS. It sits under your broader incident response plan and tells analysts exactly what to do, in what order, including who to notify, what evidence to preserve, and what containment actions to take for that specific scenario.

Who should be on an incident response team?

A complete CSIRT includes an IR lead, SOC analysts across tiers, a forensic analyst, legal counsel, IT operations, and a communications representative. Senior business stakeholders from affected units should also be contactable. Smaller teams often supplement internal staff with a managed SOC provider to cover gaps in coverage and specialist expertise.

What is the first step after a breach?

The first step is containment without destroying evidence. Isolate affected systems from the network, preserve memory and log data, and document your initial observations before making any changes. Rushing to clean up before preserving forensic evidence is the most common and costly mistake teams make in the first 30 minutes after confirming a breach.

Building a strong incident response capability takes time, but it starts with understanding the process and getting the right training. Whether you are an IT generalist moving into security or a Tier 1 analyst aiming for IR specialist roles, the 3.0 University SOC Analyst course gives you the practical foundation to work through all six phases of an incident response plan with confidence. The demand is real, the skill gap is real, and the organizations that invest in IR training now will be the ones that contain breaches in days instead of months.

Last updated: July 2026. Reviewed by the 3University editorial team.