The incident response lifecycle explained: NIST phases from preparation to lessons learned

The classic phases

NIST SP 800-61 Revision 2 described four phases that most teams still use: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity. The phases loop: lessons learned feed back into preparation, and analysis often continues during containment.

Revision 3, published in 2025, reframes incident response around the NIST Cybersecurity Framework 2.0 functions: Govern, Identify, Protect, Detect, Respond, and Recover. The practical work is the same, but it emphasizes that incident response is part of overall risk management, not a separate activity.

What happens in each phase

Preparation: plans, roles, contact lists, tooling, logging, and practice. Detection and analysis: confirm an incident, scope it, and prioritize. Containment: stop the spread, short-term and long-term. Eradication: remove the cause, such as malware, accounts, or vulnerabilities. Recovery: restore systems and watch for recurrence. Post-incident: review what happened and improve.

Lab: map a scenario to phases

Take a short scenario: a user reports a strange pop-up, the endpoint tool shows a suspicious process connecting to an external IP, and two more hosts show the same process the next morning. Write what your team would do in each phase, who would do it, and which evidence you would preserve. Mark which tasks you could not perform today because a tool, permission, or contact is missing; those are preparation gaps.

Preparation is where incidents are won

Teams that respond well have already decided who declares an incident, who can isolate a host, who talks to legal and leadership, and where the logs are. Practise with tabletop exercises and keep the plan short enough to use under stress.