What is the goal of the Response step, and what three factors determine the reaction chosen?

Response aims to contain actual or potential damage and protect the most important assets, buying time for mitigation and recovery.

After detection, the priority is to limit the bleeding and shield critical assets. The appropriate reaction depends on three things: the type of attack, the affected assets, and the criticality of those affected assets — isolating a test laptop is not the same as isolating a core banking server. Crucially, the response plan must be agreed in advance with all stakeholders so the incident response team can classify incidents and launch measures fast, without negotiating authority mid-crisis.