Cybersecurity Incident Response: Building an IR Plan

Most organizations will face a security incident before they face a fire, yet far more of them have a fire drill than an incident response plan. A cybersecurity incident response plan is the continuity discipline applied to the threat you are now most likely to meet. Here is what one contains and how the recognized framework has recently changed.

What an incident response plan is

An incident response plan, or IR plan, is a documented, rehearsed set of procedures for detecting, containing, and recovering from a cybersecurity incident, and for learning from it afterward. Its job is the same as any emergency plan: to replace improvisation under stress with prepared, assigned action. The definitive reference in the United States is NIST Special Publication 800-61, the framework most regulators, auditors, and cyber insurers point to.

The classic lifecycle, and what changed in 2025

For years, NIST described incident response as a four-phase lifecycle: preparation; detection and analysis; containment, eradication, and recovery; and post-incident activity. That model is still a useful way to think about the work. In April 2025, NIST published Revision 3 of SP 800-61, which restructures incident response around the six functions of the Cybersecurity Framework 2.0: Govern, Identify, Protect, Detect, Respond, and Recover. The shift is not cosmetic. It reframes incident response as a continuous part of risk management rather than a discrete event bounded by the few days around a breach, with improvement happening throughout rather than only at the end.

What to build into the plan

• Preparation. Governance, defined roles, an incident response team, tooling, and training. This is where most of the real work lives.
• Detection and analysis. How you recognize an incident, scope it, and judge its severity.
• Containment, eradication, and recovery. How you stop the spread, remove the cause, and restore systems, which ties directly to your disaster recovery capability.
• Post-incident learning. A structured review that feeds fixes back into the plan.

A plan is only as good as its rehearsal

The single most common failure is a plan that exists on paper and has never been run. The fix is the same as for any emergency plan: exercise it. A tabletop exercise built around a ransomware or data-breach scenario will expose the gaps in decision authority and communication long before an attacker does. And because a breach is also a reputational event, your IR plan should connect to your crisis communication plan, so the technical and public responses move together.

Incident response also reaches outward. Many breaches enter through a vendor, which is why it belongs alongside supply chain resilience in any serious program. We verify framework details against the primary source, per our editorial standards. More is in our Technology & Innovation section.

Frequently asked questions

What are the phases of incident response?

The long-standing NIST model uses four: preparation; detection and analysis; containment, eradication, and recovery; and post-incident activity. NIST’s 2025 revision reorganizes these around the Cybersecurity Framework 2.0 functions: Govern, Identify, Protect, Detect, Respond, and Recover.

What is NIST SP 800-61?

It is the U.S. National Institute of Standards and Technology’s guidance on cybersecurity incident response, and the most widely cited IR framework. Revision 3, published in April 2025, aligns it with the Cybersecurity Framework 2.0.

How is a cyber incident response plan different from disaster recovery?

Incident response manages the full handling of a security incident, including detection, containment, and communication. Disaster recovery focuses on restoring IT systems and data, and it is one part of what an incident response plan may trigger.

General guidance, not legal or security advice. See NIST SP 800-61 Rev. 3 for authoritative detail.