Organisations need an **incident response (IR) plan**, process, and team, as well as the technology, skills, and training to respond to security incidents appropriately. A strong incident response process is *not just a one-time action* or something that is applied only in emergencies. Instead, *IR is an ongoing process* that improves organisational security using information that is learned from each security incident. ### [[Incident Response Process]]