Incident Response Framework

CSF 2.0 Function	Phase	Activities
Govern	Policy & Oversight	Define risk strategy, assign roles (IRT), approve IMP, and ensure compliance.
Identify	Pre- & Post-Incident	Conduct risk assessments, maintain asset inventories, analyze vulnerabilities, and document lessons learned.
Protect	Prevention	Apply controls (firewalls, encryption, access management), train staff, and implement monitoring tools.
Detect	Identification & Analysis	Monitor systems, detect anomalies, investigate alerts, and confirm incidents.
Respond	Containment & Eradication	Contain, mitigate, eradicate threats, communicate with stakeholders, and document actions.
Recover	Restoration & Review	Restore systems, validate integrity, resume operations, and conduct post-incident analysis.