Information security incident management and continual improvement
What the domain tests
This domain tests security incident handling through the ITIL 4 incident management practice, its interfaces with problem management, change enablement and risk management, and the use of continual improvement to close systemic gaps.
Core rules
- Incident management minimizes negative impact by restoring normal service quickly. A security incident is an actual or suspected breach of security policy or controls.
- Distinguish event, incident, security incident and problem. An event is a change of state; a problem is a cause of one or more incidents.
- Handle security incidents through detection, classification, containment, eradication, recovery, communication and learning. Major incidents need escalation, crisis communication and legal or regulatory notification where required.
- Use emergency change where containment requires it, and update the risk register when exposure changes.
- Apply the continual improvement model after significant incidents: establish the vision, baseline, target state, actions, measurement and momentum.
- Use blameless post-incident reviews and a just culture so people report near misses and errors.
Worked example
Phishing compromises an account. SIEM detection triggers incident management. Containment disables the account and revokes sessions; eradication removes mailbox rules; recovery resets MFA. Problem management finds a legacy app without MFA, and continual improvement adds MFA and a standard change. Reasoning: incident management restores service; problem management removes the cause; improvement prevents recurrence.
Traps that cost marks
- Routing security incidents as ordinary tickets without escalation.
- Stopping at containment and skipping eradication or recovery.
- No post-incident review, or a blame-focused one.
- Failing to update the risk register and controls after the incident.
- Missing legal or regulatory notification duties.
- Confusing a problem with an incident.