Incident response
The structured process of detecting, containing, eradicating, and recovering from a security incident.
The recognized phases are preparation, identification, containment, eradication, recovery, and lessons learned. Preparation carries most of the weight, because decisions made calmly in advance are far better than decisions made at 2am with the business offline.
The most common failure is not technical. It is that nobody knows who declares an incident, who can authorize disconnecting a system, or who talks to clients, so the first hours go to arguing rather than containing.
Where this comes up
Incident response sits inside our cybersecurity and threats work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.