Structured incident response workflow following NIST SP 800-61. Guides teams through six phases — Detection, Triage, Containment, Investigation, Remediation, and Post-Mortem — each with checklists, prompts, and evidence-collection guidance.