Information Security Incident Management
This domain tests the operational process: how an organization moves from a report to a controlled response and then to improvement. Expect questions on phase order, severity and escalation, containment versus eradication, evidence handling, and post-incident review.
The process in practice
- Plan and prepare establishes the incident management policy, plan, IRT, communication routes, severity matrix, tools, training and exercises. ISO/IEC 27035-2 supports this planning; ISO/IEC 27035-3 addresses ICT response operations. Without this phase, response becomes improvisation.
- Detection and reporting uses monitoring, automated alerts and user reports. A single reporting channel and a logged ticket prevent incidents from being lost or handled twice.
- Assessment and decision confirms whether the event is an incident, assigns severity from business impact and urgency, names an owner and decides on escalation and notification.
- Responses normally follow containment, eradication, recovery and communication. Containment limits spread; eradication removes the cause; recovery restores services. Evidence must be preserved throughout, and legal, privacy and communications functions may need to be involved.
- Lessons learned reviews root cause, response effectiveness and control gaps, then updates the plan, training and controls.
Worked example
At 09:10, EDR flags file-server FS-02 encrypting documents. Users report inaccessible shares. The IRT confirms multiple departments are affected, backups exist but restoration is untested, and a ransom note is present. The team declares a major incident, isolates FS-02, disables the compromised account, preserves memory and disk evidence, activates crisis communications, and restores from an offline backup after eradication. The post-incident review finds a shared admin account and untested backups; both are corrected.
Traps that cost marks
Wiping and reinstalling before capturing evidence; treating containment as eradication; paying a ransom without management and legal decisions; closing the ticket after recovery without lessons learned; and using no documented severity criteria.