NIST Incident Response
NIST SP 800-61 four-phase incident response loop.
Rendering…
Make it your own.
flowchart LR
Prep[Preparation:\nIR plan, tooling, training] --> DA[Detection &\nanalysis]
DA --> Cont[Containment, eradication\n& recovery]
Cont --> Post[Post-incident activity:\nlessons learned]
Post -. update plan .-> Prep
DA -.->|escalate| Cont
Cont -.->|new evidence| DA