Incident Response: The Six Phases
On this page
A structured incident response process turns the chaos of a breach into a repeatable procedure that a team can execute under pressure. The widely used six-phase model gives everyone a shared map of what to do and in what order — because during a real incident, “what do we do now?” is the worst question to be answering from scratch.
The six phases#
| Phase | Goal |
|---|---|
| Preparation | Have the plan, tools, and training ready |
| Identification | Confirm and scope the incident |
| Containment | Limit damage and stop the spread |
| Eradication | Remove the threat and its footholds |
| Recovery | Restore systems safely and verify |
| Lessons learned | Improve so it does not recur |
Preparation happens before anything goes wrong; the middle four are the live response; lessons learned closes the loop back into preparation. It is a cycle, not a line.
Why does the order matter?#
Because each phase depends on the last. You cannot contain what you have not identified, and you should not eradicate before you have contained — stopping the spread and preserving evidence come before cleanup. Skipping preparation is the most common and costly mistake: teams that improvise their first response lose precious time and make errors that proper readiness would prevent.
The six phases are the backbone of incident response. See how to build the plan in incident response plan and more at the Defense & Hardening hub.
Frequently asked questions#
What are the phases of incident response?
A widely used model has six phases: preparation, identification, containment, eradication, recovery, and lessons learned. Preparation happens before any incident; the middle four handle the active response; and lessons learned feeds improvements back into preparation. The cycle turns each incident into better readiness for the next.
Why is containment before eradication?
Because you must stop the bleeding before you clean the wound. Containment limits the damage and prevents spread — isolating affected systems — while you still investigate. Rushing to eradicate without first containing can tip off the attacker, destroy evidence, or let the compromise spread while you focus elsewhere.