Incident Detection, Response, and Prevention

Overview

Cyber incidents are capable of demonstrable harm to the national security interests, foreign relations, or economy of the United States or to the public confidence, civil liberties, or public health and safety of the American people. Because of this risk, all organizations and even individuals should have clear, executable cyber incident detection, response, and prevention strategies. Cyber attacks are evolving and becoming increasingly complex and hard to detect. By working with all levels of government and the private sector, CISA understands the broad range of cyber vulnerabilities and offers the tools and resources needed to detect, respond to, and prevent cyber incidents accurately and effectively.

CISA’s Role

When cyber incidents occur, CISA provides response efforts to mitigate spread of the attack and secure critical infrastructure components. CISA works in close coordination with other agencies with complementary cyber missions, as well as private sector and other non-federal owners and operators of critical infrastructure, to ensure greater unity of effort and a whole-of-nation response to cyber incidents.

We provide awareness of vulnerabilities, mitigation, and prevention steps to American homes and organizations, and have programs dedicated to helping impacted organizations. We also work to notify relevant stakeholders of elevated risk exposure, conduct incident management operations, provide vulnerability assessments, and directly deploy risk management information, tools, and technical services to mitigate risk, including regulatory enforcement where authorized.