Incident response
Prepare a usable response plan, triage observations, preserve evidence, run a discussion exercise and turn lessons into verified improvements.
Incident response depends on decisions as much as technical investigation. Someone must establish what is known, decide who needs to act, protect useful evidence and coordinate service recovery. Preparation makes those responsibilities easier to exercise under pressure.
These guides are for organisations building or improving that capability. They provide original worked documents and a fictional exercise. They are introductory planning material, not an emergency response service or a substitute for the people authorised to manage your systems.
Choose the task you need to complete
| Task | Starting point | Practical output |
|---|---|---|
| Establish who does what during an incident | Prepare a plan | A plan outline, authority table and list of preparation gaps |
| Understand a suspicious observation | Triage an incident | A record that separates observations, hypotheses and decisions |
| Keep useful investigation material | Handle evidence carefully | An evidence register and transfer example |
| Rehearse decisions in a safe setting | Run a tabletop exercise | A complete discussion scenario with facilitator notes |
| Improve after an incident or exercise | Post-incident review | A review agenda and owned action register |
If a real incident may be under way, use your organisation's established escalation route and authorised response team. A public article cannot assess your live environment or determine which containment action is safe for it.
Start with a plan people can use
For a fictional service team, a useful first plan might identify the incident lead, deputy, technical responder, business owner and communications contact. It should explain how to reach them if ordinary email is unavailable and who can approve a disruptive change. Test whether a colleague can find those answers without the plan's author present.
Then practise a realistic decision. The incident-exercise planner helps you state the objective, present timed prompts and record improvements. An exercise produces evidence of what people discussed or demonstrated; it does not prove an untested backup or recovery process works.
Use the current framework deliberately
NIST SP 800-61 Revision 3, published in April 2025, supersedes Revision 2. It places response within wider cyber risk management, connecting preparation, detection, response, recovery and improvement. These guides use that current reference alongside UK NCSC material.
The 2019 conference archive records historical incident-planning and exercise subjects. Those records provide context; the practical material here is newly written and is not represented as the speakers' advice or endorsement.
Keep the decisions and their evidence together
Across all five guides, keep three things distinct: what someone observed, what the team currently believes, and what it decided to do. The distinction makes uncertainty visible without preventing useful action. It also gives the review a reliable account of what was known at the time.
Sources and further reading
- NIST SP 800-61 Revision 3: Incident Response Recommendations and Considerations (April 2025) — checked 2 November 2026
- NCSC 10 Steps to Cyber Security: Incident management — checked 2 November 2026