NIST SP 800-61 describes the lifecycle as preparation, detection and analysis, containment, eradication and recovery, and post-incident activity. Preparation is the part you can only do before the incident.
Incident response
The organised process of detecting, containing, removing and learning from a security incident.