ISACA - Incident Response Models
The document describes key activities within each phase but emphasizes that these phases should not be viewed as linear. NIST acknowledges that IR teams will likely move between phases several times during an incident.