The NIST/SANS Incident Response Framework
Standard phases for responding to incidents
The NIST and SANS frameworks are the most widely adopted references for structuring an incident response process, and although they differ slightly in how they group the phases, both cover preparation, detection and analysis, containment, eradication, recovery and lessons learned. In practice, adopting one of these frameworks doesn't mean copying a generic document, but adapting it to the organization's reality, precisely defining who carries out each phase, with what tools and under what decision criteria, because a framework without that adaptation remains theory nobody follows in a real crisis. The preparation phase is usually the most underestimated, although it's the one that determines whether the other phases are carried out quickly or improvised, since it includes having runbooks ready, emergency access configured and a trained team before the first incident occurs. Using a recognized framework also makes audits and certifications easier, because it shows the organization follows a structured process and doesn't react in a completely ad hoc way.