Is there an incident-response process?

Yes. Incidents are assessed, classified, investigated, contained, remediated, communicated, documented, and reviewed for improvement.