IROP key terms

A documented plan describing how an organisation prepares for, detects, responds to, and recovers from security incidents, including roles, escalation paths, communications, and review steps.

The repeating sequence of phases used to manage security incidents, typically preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned.

An event or series of events that actually or potentially threatens confidentiality, integrity, or availability of information systems or data, requiring coordinated response action.

An observable occurrence in a system or network, such as a login, file change, or connection, that may be benign and only becomes an incident after analysis shows harm or risk.

The rapid assessment of a reported alert or event to decide whether it is a genuine incident, how urgent it is, and who should handle it next.

A defined scale, such as low to critical, used to rank incidents by business impact and urgency so that response effort and notification obligations are applied consistently.

The documented sequence of people, teams, and contact methods used to raise an incident to higher authority or expertise when it exceeds defined thresholds or time limits.

The single accountable person who coordinates the response, assigns tasks, makes operational decisions, and communicates status during an active incident.

The group of technical, legal, communications, and management staff with defined roles who carry out investigation, containment, recovery, and reporting activities during an incident.

A table mapping each response activity, such as containment or notification, to the person or team accountable, responsible, consulted, and informed for that activity.

A step-by-step operational guide for handling a specific incident type, listing commands, decision points, contacts, and expected outcomes so responders act consistently under pressure.

A higher-level documented strategy for a category of incident, describing objectives, decision criteria, and coordination approach rather than exact technical commands.

The response action of limiting an incident's spread and damage, for example by isolating hosts, blocking network traffic, or disabling compromised accounts, before eradication begins.

The phase in which the root cause and malicious artefacts, such as malware, persistence mechanisms, or unauthorised accounts, are removed from affected systems.

The phase of restoring affected systems and data to normal operation, validating that they are clean and functional, and monitoring closely for signs of recurrence.

A structured meeting after resolution that examines what happened, what worked, what failed, and which corrective actions and plan updates are required.

A maintained log of findings and improvement actions from post-incident reviews, with owners and due dates, used to track whether the response capability actually improves.

A documented, unbroken record of who collected, handled, transferred, and stored evidence, and when, so that its integrity can be defended in legal or disciplinary proceedings.

The practice of capturing logs, memory, disk contents, and other artefacts in a way that keeps them authentic and unaltered for investigation, audit, or legal use.

A bit-for-bit copy of a storage device or memory region, taken with a documented method and verified by hash, so analysis can occur without altering the original.

The legal or contractual duty to inform regulators, affected individuals, or partners about a security incident involving personal or protected data within specified time limits.

The fixed period, often expressed in hours from awareness, within which an incident must be reported to a supervisory authority or sector regulator.

The assessment of whether an incident is significant enough to require disclosure to investors, regulators, or customers, based on financial, operational, and reputational impact.

A study identifying critical business processes, their dependencies, and the tolerable downtime and data loss for each, used to prioritise incident response and recovery effort.

The maximum acceptable elapsed time to restore a process or system after disruption, used to set recovery priorities and judge whether response is meeting business needs.

The maximum acceptable amount of data loss measured in time before a disruption, which determines backup frequency and restore strategy requirements.

Documented arrangements for keeping or resuming critical operations during and after disruption, which the incident response plan must align with during major incidents.

A discussion-based simulation in which participants walk through a realistic scenario to test plans, decision-making, communications, and role clarity without affecting live systems.

The defined set of internal and external audiences, message owners, channels, approval steps, and timing used to keep stakeholders informed during an incident.

A designated individual or channel through which all information about an incident flows, preventing conflicting messages and ensuring stakeholders receive consistent updates.

A communication channel kept separate from the compromised network, such as a pre-arranged phone bridge, so responders can coordinate when primary systems are untrusted.

The principle that users, services, and response tools receive only the access needed for their tasks, limiting both attacker reach and accidental damage during response.

The defined period for which system, network, and application logs are kept, balancing investigation and compliance needs against storage cost and privacy limits.

A chronological record of system and user activity that supports reconstruction of events, detection of anomalies, and demonstration of compliance during reviews.

A structured assessment of privacy risks from processing personal data, often required before high-risk activities and revisited when an incident reveals new exposure.

A condition a candidate must satisfy before sitting the exam or being certified, such as identity verification, required training, or an approved application.

A confirmed booking of a date, time, and location or remote slot for sitting the exam, which may be rescheduled or cancelled under stated rules.

The process of confirming a candidate's identity at check-in using accepted photographic identification that matches the name on the registration record.

The published rules governing conduct, permitted items, security checks, and behaviour at an exam venue or remote proctoring session, breach of which can void results.