Incident Lifecycle

Definitions

1. The full sequence of stages a security incident moves through, typically including preparation, detection, analysis, containment, eradication, recovery, and lessons learned. Understanding the incident lifecycle helps teams assign responsibilities and avoid skipping critical steps under pressure.

   In plain English: The full set of stages a security incident goes through from discovery to closure.

   Example: "Their postmortem showed the incident lifecycle broke down between containment and recovery because ownership was unclear."

Related Terms

• Blameless Postmortem
• Incident Playbook
• Auto-Escalation
• Cyber Exercise
• First Responder
• Incident Classification
• Incident Communication
• Incident Coordination