Incident management is the process of identifying, reporting, assessing, responding to and learning from information security events.
Security incident management (ISO 27002 clauses A.5.24-A.5.28) establishes a structured approach to detect, report, assess and respond to security events. It includes severity classification, escalation, containment, eradication, recovery and post-incident analysis.
An event is any observed occurrence. An incident is an event compromising the confidentiality, integrity or availability of information.
It depends on risk. Organizations with high cybersecurity risk benefit from a formal or outsourced CSIRT.
Need an assessment in this area?