Fundamental Principles and Concepts of Information Security Incident Management
This domain tests the vocabulary and principles that keep incident work disciplined rather than ad hoc. Expect questions on the difference between an event and an incident, the policy–plan–IRT relationship, risk-based classification, and continual improvement.
Core rules and concepts
- An information security event is an identified occurrence indicating a possible breach of policy or failure of controls. Most events are benign and require triage, not full response.
- An information security incident is a single or series of unwanted or unexpected events with a significant probability of compromising business operations and threatening information security. The phrase “significant probability” makes business context part of the definition.
- Incident management is the overall coordinated approach: policy, plan, roles, processes, tools, measurement and improvement. Incident response is the action taken on a specific incident within that framework.
- ISO/IEC 27035-1 organizes the process into five phases: plan and prepare; detection and reporting; assessment and decision; responses; lessons learned. The phases are iterative in practice, but the exam often tests their logical order.
- Management commitment, a documented incident management policy, a cross-functional incident response team (IRT), clear escalation paths, stakeholder communication and evidence preservation are core principles.
Worked example
A user reports five failed logins from an unfamiliar IP address, with no successful authentication. That is an event. If the same account later logs in at 02:00 and downloads 200 customer records, it becomes an incident: an unwanted event with a significant probability of threatening confidentiality and business operations. The analyst should classify it, escalate it, preserve logs and invoke the plan-not just reset the password and close the ticket.
Traps that cost marks
Treating every alert as an incident; equating incident management with the IRT alone; ignoring the business-context test in the definition; skipping lessons learned because service was restored.