Structured process for managing and resolving cybersecurity incidents, from detection and containment to eradication, recovery, and post-incident analysis. Includes methodologies, frameworks (NIST, SANS), operational playbooks, coordination between technical and legal teams, and integration with SOC, SIEM, EDR, and threat intelligence.