Incident response lifecycle

Preparation, detection, containment, eradication, recovery. The shape has not changed in decades because it describes the order the problems arrive in.

The one people skip is preparation, and it is the only phase you can do calmly. Everything after the alert happens under pressure with incomplete information. What separates organisations that cope from ones that do not is almost entirely work done before anything happened.