ISO 27035 LIM key terms

A single or series of unwanted or unexpected information security events that have a significant probability of compromising business operations and threatening information security.

An identified occurrence of a system, service, or network state indicating a possible breach of information security policy or failure of controls, or a previously unknown situation relevant to security.

A documented statement of top management's intent and direction for handling information security incidents, defining scope, objectives, roles, and commitment to continual improvement.

The discipline of detecting, reporting, assessing, responding to, and learning from security incidents through a structured, repeatable, and documented set of processes and controls.

The structured set of activities, from planning and preparation through detection, assessment, response, and lessons learned, that an organization follows to manage security incidents consistently.

The first phase of the incident management process in which policy, roles, resources, communication channels, and response capabilities are established before incidents occur.

The phase in which events are monitored, identified as potential incidents, and reported through defined channels to the responsible handling function in a timely manner.

The phase in which a reported incident is analyzed to confirm its nature and severity and a decision is made on whether and how to respond.

The phase covering containment, eradication, recovery, and communication actions taken to limit harm, remove the cause, and restore normal operations after an incident is confirmed.

The post-incident activity of reviewing what happened, identifying root causes and control gaps, and feeding improvements back into the incident management process.

The rapid sorting and prioritization of detected events to decide which require immediate investigation, which are benign, and which should be escalated as incidents.

A documented plan describing how an organization will detect, respond to, and recover from security incidents, including roles, escalation paths, procedures, and communication arrangements.

A designated group of people with defined responsibilities, authority, and skills to coordinate and execute the response to information security incidents.

The documented allocation of duties and decision authority among individuals and functions involved in incident management, such as reporting, triage, response, and communication.

A classification of an incident's impact and urgency, used to prioritize response effort, determine escalation, and trigger notification obligations.

The process of raising an incident to higher levels of authority or additional functions when it exceeds defined thresholds, requires more resources, or has significant business impact.

The action of limiting the spread and impact of an incident, for example by isolating affected systems, blocking access, or applying short-term controls.

The action of removing the cause of an incident, such as eliminating malware, closing the exploited vulnerability, or revoking compromised credentials.

The action of restoring affected systems, services, and data to normal operation, verifying integrity, and monitoring for recurrence after containment and eradication.

The act of notifying the designated contact point about a suspected or confirmed incident through defined channels, including required internal and external notifications.

Legal, regulatory, contractual, or internal requirements to inform authorities, customers, partners, or other stakeholders about an incident within specified timeframes.

A documented approach for internal and external incident communications, covering audiences, messages, spokespeople, channels, and timing during and after an incident.

The controlled collection, preservation, and documentation of digital and physical evidence so that it remains reliable for investigation and possible legal or disciplinary proceedings.

A documented record of who handled evidence, when, where, and for what purpose, used to demonstrate that evidence has not been altered or compromised.

The application of investigative techniques to collect and analyze digital evidence in a manner that supports understanding of an incident and potential legal or disciplinary action.

A predefined, step-by-step procedure for handling a specific incident type, such as ransomware or phishing, that guides responders through consistent actions and decisions.

A structured meeting and analysis after an incident closes to evaluate response effectiveness, identify root causes, and agree on corrective actions with owners and deadlines.

The ongoing process of measuring incident management performance, identifying weaknesses, and implementing changes to improve capability, effectiveness, and efficiency over time.

Defined measures such as incident counts, detection and response times, and recurrence rates, reported to management to demonstrate performance and inform improvement decisions.

Planned activities such as tabletop exercises, simulations, or technical tests that validate the incident response plan and reveal gaps before a real incident occurs.

A log recording details of reported incidents, including classification, status, actions taken, and outcomes, supporting tracking, reporting, and trend analysis.

The participation of external parties such as suppliers, service providers, or authorities in incident handling, requiring defined coordination, communication, and contractual arrangements.

A structured investigation to determine the underlying reason an incident occurred, so that corrective actions address the cause rather than only the symptoms.

The formal step of confirming that response actions are complete, affected parties are informed, records are updated, and follow-up actions are assigned before an incident is marked resolved.

Training and communication that help staff recognize, report, and avoid worsening security incidents, including clear instructions on whom to contact and what not to do.