Incident response is an organized approach to addressing and managing the aftermath of a security breach or attack (also known as an incident). The goal is to handle the situation in a way that limits damage and reduces recovery time and costs.

An incident response plan includes a policy that defines, in specific terms, what constitutes an incident and provides a step-by-step process that should be followed when an incident occurs.

An organization’s incident response is conducted by the Computer Incident Response Team, a carefully selected group that, in addition to security and general IT staff, may include representatives from legal, human resources, and public relations departments.