Identification: Detecting and acknowledging the incident. Containment: Limiting the impact of the incident to prevent further damage. Eradication: Eliminating the root cause of the incident. Recovery: Restoring normal operations and services. Lessons Learned: Reviewing the incident and the response to improve future efforts.