IR-4 - Incident Handling

IR-4 establishes an organization's incident handling capability, requiring documented processes for detecting, analyzing, and responding to security incidents. It mandates coordination of response activities, containment, eradication, recovery, and post-incident reporting to improve future resilience.