- Identification: Procedures for detecting and identifying incidents. - Containment: Strategies to limit the spread and impact of the incident. - Eradication: Steps to eliminate the cause of the incident. - Recovery: Plans to restore normal operations and services. - Lessons Learned: Post-incident analysis to improve future responses.