How incident response works
Common models, such as the NIST lifecycle, describe phases: preparation, detection and analysis, containment, eradication and recovery, and post-incident activity. Preparation includes plans, contact lists, tooling, logging and exercises, so decisions are not improvised during a crisis.
During an incident, responders confirm what is happening, scope the impact, isolate affected systems, remove the attacker's access and restore from clean sources. Evidence is preserved, communications are coordinated, and lessons are fed back into controls and the plan. Clear severity definitions help teams decide quickly who to involve, while pre-approved containment actions, such as isolating a host, avoid delays waiting for permission during an attack.
Why it matters for Canadian organizations
Speed and coordination drive outcomes. Canadian organizations must consider notification obligations: PIPEDA requires reporting breaches that pose a real risk of significant harm, Quebec Law 25 has its own incident requirements, and OSFI B-13 sets expectations for regulated institutions.
Insurers and customers also expect a documented, tested response capability. Organizations without one often lose time deciding who is in charge, which prolongs outages and increases the cost of the event. Backups deserve special attention, because attackers often target them first; keep copies that are offline or immutable and test restoration so recovery time is known in advance.
How to implement it
Write a plan that names roles, decision authority, communication channels and escalation criteria, including legal, executive and external contacts. Keep it accessible if systems are down.
Run tabletop exercises at least annually, ensure logging supports investigation, and keep offline backups. Consider an incident response retainer so experienced responders are available immediately when you need them. After each incident, hold a blameless review, record what worked and what did not, and track the resulting improvements until they are complete. Keep contact details printed offline.
Frequently asked questions
What are the phases of incident response?
A widely used model has four stages: preparation; detection and analysis; containment, eradication and recovery; and post-incident activity. Some frameworks split them into six steps, but the sequence is the same: get ready, find it, stop it, fix it and learn.
What should be in an incident response plan?
A plan should define roles and contacts, severity levels, escalation and decision authority, containment and recovery procedures, evidence handling, communication and notification steps, and review activities. It should be short enough to use under pressure and tested regularly.
Who should be on an incident response team?
Typically security analysts, IT and system owners, a response lead, legal and privacy advisors, communications staff and an executive sponsor. Smaller organizations often supplement with external specialists on retainer for forensics and surge capacity.
Related service: Incident response