The middle of a security incident is the worst possible time to figure out what to do. An incident response (IR) plan written and rehearsed in advance turns panic into process. It does not need to be a hundred-page document — for an SME, a clear, practical plan covering the essentials is far more valuable than an unread tome.
The six phases of incident response
A solid plan walks through six phases drawn from established frameworks: Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned. Each phase has clear actions and owners.
1. Preparation
Build the foundations before anything happens: an asset inventory, contact lists, defined roles, and the tools you will need. Decide who leads the response, who talks to staff and customers, and who has authority to take systems offline.
2. Identification
Define what counts as an incident and how it gets reported. Establish monitoring and a single reporting channel so suspicious activity reaches the right people quickly. Speed of detection directly limits damage.
3. Containment
Stop the bleeding. Isolate affected systems from the network, disable compromised accounts, and preserve evidence for later analysis. Distinguish short-term containment (pull the plug) from longer-term containment (rebuild while keeping the business running).
4. Eradication
Remove the threat completely — delete malware, close the vulnerability that allowed entry, and reset compromised credentials. Half-measures here lead to reinfection.
5. Recovery
Restore systems from clean backups, validate they are functioning normally, and monitor closely for signs the attacker returns. Bring services back in a controlled, prioritized order.
6. Lessons learned
Within a couple of weeks, hold a blameless review. What happened, how did you respond, and what would make next time better? Feed those improvements back into the Preparation phase.
Rehearse it
A plan no one has practiced is a document, not a capability. Run a tabletop exercise at least annually where the team walks through a realistic scenario. This surfaces gaps while the stakes are low.
Write the plan, assign the roles, and rehearse the scenario. When a real incident comes — and statistically it will — you will respond with calm competence instead of improvisation.
Korur Security Team
Korur Güvenlik Ekibi