Incident Response
Investigating containing and recovering from incidents
Linked Roles
2
Readiness Models
2
Recorded People
2
Competency Overview
Investigating security or service incidents, coordinating containment and supporting recovery and learning.
Key capabilities
- Triage and incident assessment
- Containment and recovery coordination
- Post-incident reporting and learning
Where it's used
See all relationships →Security Architect
Role · Required · L4/5
Cybersecurity Engineer
Role · Required · L3/5
Cybersecurity Assessment
Readiness · L4/5
IT Operations
Readiness · L3/5
Links reflect current Role and Readiness Model requirements, not verified staff qualifications.
Proficiency Reference
General TalentForge 1–5 scale. Skill-specific observable criteria have not been defined.
AwarenessRecognizes the core concepts and terminology.
BasicPerforms routine activities with guidance.
ProficientWorks independently in common situations.
AdvancedHandles complex cases and supports others.
ExpertProvides expert guidance and sets good practices.
Levels 1–5 are ordinal, not percentages. Criteria describe skills; they are not personal assessments.
Catalog Information — identifiers, classifications and scope
- Skill ID
skill-incident-response- Primary family
- Security
- Category
- Security Operations
- Type
- Technical
- Aliases
- None recorded
- Tags
- None recorded
- Status
- Active
- Definition version
- 1
Competency scope
Incident handling workflow; authority to act depends on assigned responsibilities.