Why this matters
When an attack is confirmed, panic causes more damage than the attacker. Ghanaian telco and bank adverts list incident response, containment and escalation as core duties. Ghana's Cybersecurity Act, 2020 also sets a reporting duty, so organisations need staff who know the process.
The incident response stages
Many teams still use the incident response lifecycle from earlier guidance by the US National Institute of Standards and Technology (NIST). NIST's latest version, SP 800 61 Revision 3, now links incident response to the six functions of the NIST Cybersecurity Framework 2.0, but the stages below remain a common, simple way to remember the work:
- Preparation: plans, contact lists, playbooks, backups and training, done before anything happens.
- Detection and analysis: spotting the incident, confirming it is real, and working out scope: which systems, which accounts, which data.
- Containment: stopping it spreading, for example disconnecting a computer from the network or disabling an account.
- Eradication: removing the cause, such as malware or an attacker's backdoor account.
- Recovery: restoring systems and data safely, often from backups, and watching closely for signs of return.
- Lessons learned: a calm review of what happened and what to improve, without blame.