Incident Response 101: The NIST 6-Step Process

When a security incident hits, panic is the enemy. The teams that recover fastest are the ones following a repeatable process instead of improvising. The most widely used framework for this is the National Institute of Standards and Technology (NIST) incident response lifecycle. This guide explains the NIST 6-step process in plain language, with practical SOC examples for each phase, so you understand not just what to do but why each step matters.

Key Takeaways

• Incident response (IR) is a lifecycle, not a single reaction; each phase feeds the next.
• The six steps are: Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned.
• Preparation does the heavy lifting; the work you do before an incident decides how well you handle one.
• Containment buys time to investigate without letting the attacker spread further.
• Lessons Learned turns pain into improvement and should always produce concrete action items.

Why a Framework Matters

NIST publishes its guidance in Special Publication 800-61, the Computer Security Incident Handling Guide. It gives organizations a common language and a proven sequence so that under pressure, everyone knows their role. While NIST technically groups the work into four phases, the industry commonly teaches it as six discrete steps for clarity. We will use the six-step version here.

Step 1: Preparation

Preparation is everything you do before an incident occurs. This is where most of the value is created. It includes building an incident response plan, defining roles, setting up logging and monitoring, deploying detection tools, and running tabletop exercises so the team has practiced the drill.

Practical preparation checklist:

• A written, tested IR plan with clear escalation paths.
• Centralized logging (a SIEM) with sufficient log retention.
• An asset inventory so you know what you are protecting.
• Contact lists for legal, communications, and management.
• Access to forensic and containment tools before you need them.

Step 2: Identification (Detection and Analysis)

This is where the SOC earns its keep: detecting that something is actually wrong and confirming it is a genuine incident, not a false positive. Alerts arrive from the SIEM, endpoint detection tools, user reports, or threat intelligence.

Analysts triage by asking: What triggered the alert? Which systems are affected? Is this normal behavior or malicious? A key task is establishing scope and severity so the response is proportionate. Documenting a clear timeline from the first indicator is essential for everything that follows.

Step 3: Containment

Once an incident is confirmed, the priority is to stop the bleeding without destroying evidence. NIST distinguishes between short-term containment (immediate actions like isolating an infected host from the network) and long-term containment (temporary fixes that let business continue while you prepare a full cleanup).

Common containment actions include isolating endpoints, disabling compromised accounts, blocking malicious IPs or domains at the firewall, and applying emergency access rules. The goal is to limit damage and prevent lateral movement while you investigate.

Step 4: Eradication

With the threat contained, eradication removes it entirely. This means deleting malware, closing the vulnerabilities that were exploited, removing attacker persistence mechanisms (rogue accounts, scheduled tasks, backdoors), and rotating any credentials that may have been exposed.

Eradication must be thorough. If a single backdoor is missed, the attacker simply returns. This is why identification and forensic analysis in earlier steps are so important; you can only remove what you have found.

Step 5: Recovery

Recovery restores affected systems to normal operation and confirms they are clean and functioning. This includes restoring from known-good backups, rebuilding compromised machines, carefully monitoring restored systems for signs of reinfection, and gradually returning services to production.

A cautious, monitored return is critical. Bringing systems back too quickly, before you are sure the threat is gone, risks a repeat incident. Many teams keep enhanced monitoring on recovered assets for a defined watch period.

Step 6: Lessons Learned (Post-Incident Activity)

Within a week or two of closing the incident, the team holds a post-incident review. The aim is improvement, not blame. Key questions include:

• What happened, and on what timeline?
• How well did our detection and response perform?
• What could have caught this sooner?
• Which controls, playbooks, or training need updating?

The output should be concrete action items with owners and deadlines. This step closes the loop by feeding improvements straight back into Preparation, making the whole lifecycle stronger for next time.

Putting It Together

The NIST lifecycle works because it is cyclical. Every incident, handled well, leaves the organization better prepared than before. New analysts often focus only on the exciting containment and eradication phases, but seasoned responders know that disciplined preparation and honest lessons-learned reviews prevent far more damage. If you want to practice this workflow with realistic scenarios, the SOC Analyst track at TechBiz Security Academy builds the muscle memory that makes calm, structured response second nature.

Frequently Asked Questions

Is it four steps or six steps in NIST?

NIST SP 800-61 formally describes four phases: Preparation; Detection and Analysis; Containment, Eradication and Recovery; and Post-Incident Activity. The industry often expands the middle phase to teach six distinct steps for clarity. Both describe the same lifecycle.

What is the most important phase of incident response?

Preparation. The decisions, tooling, and training put in place before an incident determine how quickly and effectively a team can detect, contain, and recover from it.

What is the difference between containment and eradication?

Containment limits the spread and damage of an active threat, for example by isolating an infected host. Eradication then removes the threat completely, such as deleting malware and closing the exploited vulnerability.

How soon should a lessons-learned review happen?

Typically within one to two weeks of resolving the incident, while details are still fresh. The review should produce specific, assigned action items that feed back into the preparation phase.