domains / families / security / incident-response-lifecycle

incident-response-lifecycle

separate

Incident response process management following the NIST 800-61 lifecycle. Covers severity classification, escalation matrices, role assignment, communication management, phased recovery coordination, blameless post-mortem facilitation, and 5-whys root cause analysis. Scoped to the process and coordination layer — for network-level evidence collection and forensic analysis, use incident-response-network instead.

When to use

• **Service-affecting incident declared** — a P1 or P2 event requires
• **Escalation decision needed** — determining who to notify at what
• **Multi-team coordination required** — investigation spans network,
• **Customer or regulatory notification required** — incident has
• **Post-incident review facilitation** — scheduling, structuring, and
• **Incident metrics reporting** — collecting MTTD, MTTI, MTTR, and

When not to use

• network-level evidence collection
• forensic analysis
• technical evidence collection
• device forensics
• containment execution

Skill page

Source