Incident Response

Overview

Cyber incidents can harm U.S. national security interests, foreign relations, and the economy and can impact public confidence, civil liberties, and health and safety. Because of this risk, all organizations should have clear, executable cyber incident response plans and strategies to protect their own interests and prevent an incident from growing and causing greater harm. 

As cyberattacks evolve and become increasingly complex, CISA works with partners to protect critical infrastructure, mitigate vulnerabilities, and reduce the impact of cyber incidents. CISA offers tools and resources needed to prevent, detect, and respond to cyber incidents accurately and effectively.

CISA’s Role in Incident Response

• Coordinates with interagency partners, critical infrastructure owners, private sector partners, and other stakeholders for a whole-of-nation response.
• Provides assistance to impacted entities and analyzes potential impacts across critical infrastructure.
• Facilitates information sharing and operational coordination among partners.
• Leads asset response under Presidential Policy Directive 41 (PPD-41) and the National Cyber Incident Response Plan (NCIRP).
• Develops frameworks and collaborates with partners to enable effective incident response, including leading the development and updating of the NCIRP.
• Notifies stakeholders of elevated risk exposure, conducts incident management operations, and provides vulnerability assessments.
• Mitigates risk by deploying risk management information, tools, and technical services.