Documented, tested process for detecting, containing, eradicating, and recovering from security incidents.
Incident Response is the documented, exercised process for handling security incidents — typically following NIST SP 800-61 phases: Preparation, Detection & Analysis, Containment-Eradication-Recovery, and Post-Incident Activity. Tabletop exercises evidence ongoing capability.
Run a free ComplianceIQ audit against SOC 2 and we'll surface every gap on this — and the other controls auditors flag — with the exact clause references to fix.