Incident Management

Incident management is the broad governance program (policies, planning, coordination, metrics); incident response is the operational, hands-on handling of a specific incident.

An event (or series of events) that compromises the confidentiality, integrity, or availability of information assets and may cause business harm.

An event is any observable occurrence; an incident is an event (or adverse event) that actually or potentially harms security, requiring response.

To minimize business impact by limiting damage, reducing recovery time and cost, and restoring normal operations.

Because it requires policy, accountability, resourcing, risk alignment, and senior management support to be effective.

Incident management is a control that treats residual risk; incidents provide feedback that informs the risk assessment and treatment cycle.