NIST SP 800-61
Even though information security professionals plan to effectively manage risk, incidents still occur. NIST SP 800-61 is the National Institute of Standards and Technology (NIST) special publication that gives guidelines for organizations on how to handle security incidents. Read section 2.2 on page 6 to learn more about the need for, and the benefits of, an incident response capability. Also read section 3 on pages 21-44 to learn how to appropriately handle information security incidents. Before you move on, make sure you can explain the four stages of the incident response process: preparation; detection and analysis; containment, eradication, and recovery; and post-incident activity.
Handling an Incident
1. Preparation
Incident response methodologies typically emphasize preparation – not only establishing an incident
response capability so that the organization is ready to respond to incidents, but also preventing incidents
by ensuring that systems, networks, and applications are sufficiently secure. Although the incident
response team is not typically responsible for incident prevention, it is fundamental to the success of
incident response programs. This section provides basic advice on preparing to handle incidents and on
preventing incidents.