# Incident Response **Domain:** Cybersecurity / Operations / Recovery **Doc Type:** Canonical Practice Node **Maturity:** Foundational ## Definition **Incident response** is the organized process of preparing for, detecting, containing, investigating, eradicating and recovering from cybersecurity incidents. ## Operational Context Effective response coordinates technical analysis, evidence preservation, communications, legal obligations, business priorities and recovery. The presence of a reporting channel does not necessarily provide an incident-response team or repair capability to the reporter. ## See Also [[wiki/Digital Forensics|Digital Forensics]], [[wiki/Disaster Recovery|Disaster Recovery]], [[wiki/Operational Continuity|Operational Continuity]], [[wiki/Internet Crime Complaint Center|IC3]]