Incident management

Incident management is the organised lifecycle for handling security incidents. The CISSP sequence runs detection, response, mitigation, reporting, recovery, remediation, and lessons learned: detect that something is wrong, respond with a triage decision, mitigate by containing the damage, report to the parties who must know, recover normal operations, remediate the root cause, and feed what was learned back into the controls and the plan itself. Detection typically arrives through monitoring tools such as a SIEM.

Two distinctions decide questions. First, an event is any observable occurrence; an incident is an event with negative consequences for the organisation. Thousands of events are logged for every incident declared. Second, containment comes before eradication: the priority once an incident is confirmed is stopping the spread, not immediately wiping the attacker out, and certainly not powering everything off, which can destroy the volatile evidence needed later.

Exam relevance: if a scenario asks what to do first once an incident is confirmed, the answer is containment (mitigation), not eradication or recovery. If it asks whether a logged occurrence is an incident, look for actual harm; without harm it remains an event. Evidence gathered during response must preserve the chain of custody from the very start, because the decision to prosecute may come long after the disk was imaged.