An incident is an event that could lead to loss of, or disruption to, an organization's operations, services, or functions. Incident management (IcM) refers to the activities an organization undertakes to identify, analyze, and correct hazards to prevent future recurrence. These incidents within a structured organization are normally dealt with by either an incident response team (IRT), an incident management team (IMT), or Incident Command System (ICS). Without effective incident management, an incident can disrupt business operations, information security, IT systems, employees, customers, or other vital business functions.
Description An incident is an event that may lead to the loss of, or disruption to, an organization's operations, services or functions. Incident management (IcM) is a term describing the activities of an organization to identify, analyze, and correct hazards to prevent a future re-occurrence. If not managed, an incident can escalate into an emergency, crisis or disaster. Incident management is therefore the process of limiting the potential disruption caused by such an event, followed by a return to business as usual. Without effective incident management, an incident can disrupt business operations, information security, IT systems, employees, customers, or other vital business functions.
Physical incident management National Fire Protection Association states that incident management can be described as, '[a]n IMS [incident management system] is "the combination of facilities, equipment, personnel, procedures and communications operating within a common organizational structure, designed to aid in the management of resources during incidents". Physical incident management is the real-time response that may last for hours, days, or longer. The United Kingdom Cabinet Office has produced the National Recovery Guidance (NRG), which is aimed at local responders as part of the implementation of the Civil Contingencies Act 2004 (CCA). It describes the response as the following: "Response encompasses the actions taken to deal with the immediate effects of an emergency. In many scenarios, it is likely to be relatively short and to last for a matter of hours or days – rapid implementation of arrangements for collaboration, coordination and communication is, therefore, vital. Response encompasses the effort to deal not only with the direct effects of the emergency itself (eg fighting fires, rescuing individuals) but also the indirect effects (eg disruption, media interest)". International Organization for Standardization (ISO), which is the world's largest developer of international standards also makes a point in the description of its risk management, principles and guidelines document ISO 31000:2009 that, "Using ISO 31000 can help organizations increase the likelihood of achieving objectives, improve the identification of opportunities and threats and effectively allocate and use resources for risk treatment". This again shows the importance of not just good planning but the effective allocation of resources to treat the risk.
Incident management in critical infrastructure Incident management in critical infrastructure environments involves coordinated response activities designed to protect essential services whose disruption may impact public safety, economic stability, or national security. Unlike incident management in purely informational or corporate IT contexts, critical infrastructure incidents often involve operational technology, physical processes, safety systems, and regulatory obligations. Critical infrastructure incident management typically emphasizes early detection, structured escalation, cross-functional coordination, and continuity of operations. Incidents may originate from cyber events, physical failures, human error, natural hazards, or combined (hybrid) causes, requiring integrated response across engineering, operations, security, executive leadership, and external authorities. Because infrastructure sectors are highly interdependent, incident management approaches in these environments often account for cascading effects across energy, communications, transportation, healthcare, and other essential services. As a result, planning and response activities commonly incorporate predefined roles, decision authorities, communication protocols, and recovery objectives aligned with safety and resilience requirements.
Computer security incident management
Today, an important role is played by a Computer Security Incident Response Team (CSIRT), due to the rise of internet crime, and is a common example of an incident faced by companies in developed nations all across the world. For example, if an organization discovers that an intruder has gained unauthorized access to a computer system, the CSIRT would analyze the situation, determine the breadth of the compromise, and take corrective action. Currently, over half of the world's hacking attempts on Trans National Corporations (TNCs) have taken place in North America (57%). 23% of attempts take place in Europe. A Computer Security Incident Response team can provide a secure environment for an organization, and has become a large part of the design of many modern networking teams.
… excerpt ends here. Continue reading the full article.
