Security Incident Management

Key steps: 

 

 Prepare: maintain an incident response plan with roles, communication trees, and escalation criteria. 

 Detect and report: ensure monitoring, logging and clear internal reporting channels. 

 Classify: use severity levels (critical, major, minor) and assign appropriate response teams.  

 Contain and eradicate: isolate affected systems and remove root causes. 

 Recover: restore services from trusted backups and validate integrity. 

 Post-incident: perform root-cause analysis, update risk registers, and publish lessons learned.