The five phases of good incident response

Put them in your Cyber Incident Response Plan

We've previously provided a handy checklist to help you draw up a Cyber Incident Response Plan. Such a plan will be invaluable if your security is ever compromised. But there's more to good incident response than having a good plan. Ideally, you should go through the following five phases. We recommend including them in your plan.

How to produce a Cyber Incident Response Plan
The 5 phases of a cyber incident response plan: preparation, identification & analysis, mitigation & resolution, recovery & testing and evaluation

Phase 1: Preparation

Preparation is vital. Put together a team that can swing into action if there's a cyber incident, and formulate a Cyber Incident Response Plan. You also need to train the team, define response processes and make sure that they're firmly embedded.

Phase 2: Identification and analysis

The second phase of a good response involves detecting the incident and sounding the alarm. At that point, it's important to gather any information that can shed light on the situation. What happened and when? Who gained access to what? Are event logs available? In some cases, such information can be used as evidence, so it's important to make sure everything is properly recorded.

Phase 3: Mitigation and resolution

Once you become aware that there's been an incident, you need to act quickly to limit and repair the damage. What that entails depends on the type of incident. If you've been hacked, for example, you may need to remove the hackers' malicious software. But if you've had a data leak, the emphasis will be on closing the relevant systems and reporting the event to the Data Protection Authority.

Phase 4: Restoration and testing

Following an incident, you'll need to restore the affected systems. They should be tested thoroughly before being released for use. Are there any signs of abnormal behaviour or anomalies in the data? Make sure your Incident Response Plan says how long the systems will require extra monitoring.

Phase 5: Evaluation

Once the dust has settled, the team should evaluate the incident and the response. Were all problems resolved? What didn't go well and could be improved in future? Update your plan in line with the conclusions.

Good luck producing your plan!

Curious to know what forms of cybercrime affect SMEs most often? Check out our whitepaper. Want to protect yourself against cyber-attacks? You might want to consider CyberSterk, the user-friendly security solution for SMEs.