What it asks for. The Respond function covers the actions taken once a cybersecurity incident has been detected. It groups outcomes for managing the incident, analysing it, reporting and communicating about it, and containing and mitigating its effects.
In practice. A mature organisation has a documented incident response plan with clear triage criteria, severity levels, named roles and escalation paths, and it executes that plan in coordination with suppliers and other parties. Analysts establish what happened and the root cause, preserve evidence with integrity, and record actions as they are taken. Stakeholders, including regulators where reporting duties apply, are informed on time, and incidents are contained and eradicated in a controlled way. Evidence includes the plan, incident tickets and timelines, exercise reports and notification records.
Common gaps. Organisations often have a plan that has never been exercised, unclear authority to declare an incident, and weak evidence handling. Regulatory notification timelines and third party involvement are frequently not built into the playbooks.