PECB ISO/IEC 27035 Foundation Exam Practice & Certification Guide key terms

A single or series of unwanted or unexpected information security events that have a significant probability of compromising business operations and threatening information security. It differs from a mere event because harm or serious risk is present.

An identified occurrence indicating a possible breach of security policy, a failure of controls, or a previously unknown situation that may be relevant to security. Most events are benign and only some escalate to incidents.

Top management's documented statement of intent and direction for handling security incidents, covering scope, objectives, roles, authority, and commitment to continual improvement. It authorizes the incident response capability and is approved at the highest level.

A documented set of procedures, responsibilities, and resources describing how the organization detects, reports, assesses, responds to, and learns from incidents. It turns policy intent into repeatable operational steps and is tested and maintained.

A designated group with defined roles, skills, and authority to coordinate the response to security incidents. It may be a permanent, part-time, or virtual team and works with internal and external parties.

The individual responsible for leading and orchestrating the response to an incident, allocating tasks, and communicating with management and stakeholders. The role may be held by the team lead or a designated duty officer.

The process by which anyone who notices a suspected security event informs the designated point of contact through defined channels. Clear, simple reporting routes increase early detection and reduce the harm caused by delay.

The rapid assessment of a reported event to decide whether it is an incident, how urgent it is, and what priority of response it warrants. Triage uses defined criteria so that limited resources go to the most serious cases first.

Assigning a reported incident to a defined category, such as malware, unauthorized access, denial of service, or data leakage, so that the correct procedures and specialists are applied. Classification also supports trend analysis and reporting.

A rating of how serious an incident's impact and urgency are, used to set response priority, escalation, and resource allocation. Severity scales are defined in advance with objective criteria and examples.

The formal process of raising an incident to higher authority, more senior responders, or additional teams when severity, scope, or duration exceeds defined thresholds. Escalation paths and triggers are agreed before incidents occur.

The immediate actions taken to limit the spread and impact of an incident while preserving evidence. Containment may be short-term, such as isolating a host, or longer-term, such as applying temporary controls until full recovery.

Removing the root cause of an incident, for example deleting malware, closing the exploited vulnerability, or revoking compromised credentials. Eradication follows containment and precedes recovery of normal operations.

Restoring affected systems, services, and data to normal operation in a controlled way after containment and eradication. Recovery includes validation, monitoring for recurrence, and confirmation that business functions are restored.

A structured post-incident review that identifies root causes, what worked, what failed, and improvements to the incident management capability. Findings are tracked to completion and fed back into policy, plans, and controls.

Any information, such as logs, disk images, or network captures, that supports analysis of an incident and may be needed for disciplinary or legal proceedings. Its integrity must be preserved through documented handling.

A documented, unbroken record of who handled evidence, when, where, and why, from collection through storage and presentation. It demonstrates that evidence has not been altered and supports its reliability in formal proceedings.

Preparing people, processes, and technology so that usable evidence can be collected quickly when an incident occurs. It includes logging standards, time synchronization, retention, and pre-approved forensic tools and procedures.

A predefined approach for informing internal and external stakeholders during an incident, covering audiences, messages, channels, timing, and approval authority. It reduces confusion and supports legal and regulatory obligations.

Informing authorities, regulators, customers, or other parties about an incident when law, contract, or regulation requires it within set time limits. Decisions rely on legal advice and documented criteria for what must be reported.

The end-to-end sequence of activities for handling incidents, typically covering planning and preparation, detection and reporting, assessment and decision, responses, and post-incident learning. It provides a common structure for policy and procedures.

The activity of identifying that a security event or incident has occurred, using monitoring tools, alerts, audit reviews, and reports from users or third parties. Effective detection depends on adequate logging, baselines, and trained observers.

The combined people, processes, technology, and governance an organization maintains to handle security incidents. It is built deliberately, resourced, exercised, and improved rather than emerging by accident.

Exercising incident procedures through tabletop scenarios, simulations, or technical drills to verify that plans work and participants understand their roles. Results drive corrective actions and updates to the plan.

A systematic method for determining the underlying reason an incident occurred, rather than only its immediate symptoms. Its findings justify corrective actions that prevent recurrence and inform risk treatment decisions.

An action taken to eliminate the cause of a detected nonconformity or incident and prevent it from happening again. Corrective actions are recorded, assigned, tracked, and verified for effectiveness.

The ongoing process of enhancing the incident management capability through measurement, review, and corrective action. It uses incident trends, exercise results, and audits to refine policy, plans, and controls over time.

Visible support from senior leaders for incident management, shown through approved policy, allocated resources, defined authority, and participation in reviews. Without it, response capabilities are often underfunded and inconsistently applied.

The documented allocation of duties and decision rights among individuals and groups involved in incident management. Clear definitions prevent duplication, gaps, and delay during high-pressure response activities.

The participation of external parties such as cloud providers, forensic specialists, insurers, or law enforcement in incident handling. Agreements should define notification duties, cooperation, access, and confidentiality in advance.

A log recording each incident's details, classification, severity, actions taken, status, and outcomes. It supports tracking, trend analysis, reporting to management, and evidence of a functioning management process.

A class of tooling that collects and correlates logs and security events from many sources to detect and alert on suspicious activity. It supports monitoring and triage but does not replace human judgement.

Observable artifacts, such as unusual file hashes, IP addresses, or account behavior, that suggest a system may have been breached. They help detection and scoping but must be validated to avoid false conclusions.

The process of identifying business functions and the consequences of their disruption over time. Its results inform incident severity ratings, recovery priorities, and the resources dedicated to response.

The three core properties that information security aims to protect. Incidents are assessed by which of these properties is affected and how severely, which shapes classification and priority.

Selecting and applying options to modify risk, such as avoiding, reducing, sharing, or accepting it. Incident findings feed this process by revealing risks that were missed or underestimated.

A realistic practice scenario in which participants respond to a fictional incident to test plans, communication, and decision-making. It reveals gaps in roles, procedures, and tooling before a real crisis occurs.

A facilitated discussion held soon after an incident closes to reconstruct the timeline, evaluate decisions, and agree improvements. It should be blameless to encourage honest reporting and learning.