The structured process an organization follows to detect, contain, eradicate, and recover from a security incident.
A good incident response process moves through clear phases — preparation, detection, containment, eradication, recovery, and lessons learned — rather than reacting ad hoc under pressure.
