An organized approach to addressing and managing the aftermath of a security breach or cyberattack, with the goal of limiting damage, reducing recovery time, and preventing future incidents.