Improvised in the moment
Whoever is reachable decides what to do, in real time, under pressure. Common where nothing has ever gone wrong yet.
SECURITY · INCIDENT RESPONSE
A documented sequence, not a fast reflex under pressure
Incident response is a defined sequence for handling a security event: detect it, contain it so it stops spreading, remove the cause, recover the system, then tell the people who need to know. The sequence is what matters, not just the speed of the first reaction.
A fast reflex handles the first ten minutes. What determines whether the next ninety go well is whether the steps after that were decided in advance or improvised on the spot.
THE RANGE OF PRACTICE
What improvised looks like, and what documented looks like
Described by behaviour, not by a score.
People know roughly what to do
A shared understanding exists but nothing is written down, so it depends on who is available and what they remember.
A written sequence with defined roles
Detect, contain, eradicate, recover, communicate, each step assigned rather than assumed, reviewed after every use.
WHERE WE SIT
Detect, contain, eradicate, recover, communicate
The same documented consistency behind our Tier 3 position.
Security incident response follows that sequence as a matter of process, not something assembled after the fact. Every use of it feeds back into the documented steps, the same feedback loop that moves a practice from Tier 3, Repeatable, toward Tier 4, Adaptive, on the NIST CSF scale we publish our position against. This is a distinct, narrower discipline from the 24/7 incident line, which covers uptime and functional failures rather than a security breach specifically.
STRAIGHT ANSWERS
Questions about incident response
The ones that come up before anyone signs anything.
A defined sequence for handling a security event: detect it, contain it so it stops spreading, remove the cause, recover the system, then tell the people who need to know what happened. The word "incident response" describes that sequence, not just the act of noticing something went wrong.
Fast reflexes handle the first ten minutes. A documented process determines whether the next ninety are spent containing the problem or arguing about who owns which step. Without one, the response is improvised at the exact moment improvising is most costly.
The 24/7 line covers uptime and functional incidents, a site being down or a checkout failing. This page covers the security-specific discipline of containment and recovery when the event is a breach, a compromised credential or an exploited vulnerability, a narrower and more specific case.
A review of what happened and why, feeding back into the documented process so the same gap does not reopen. This is the same feedback loop that moves a security practice from Tier 3 toward Tier 4 on the NIST CSF scale.
Send us your website address. We will tell you what is exposed.
The free technical audit covers security headers, plugin and theme inventory, known vulnerabilities and whether your admin login is publicly reachable. Two days, no charge, no obligation.