Incident Management · Topic 1 of 5
Incident Response Plan and Incident Classification
Building the incident response plan, team roles and escalation, and classifying incidents by severity and type so the response matches business impact.
- 3 min
- Includes a diagram
- Events become incidents when they harm or threaten information or break policy.
- The IRP defines roles, authority, escalation, procedures and communication.
- Classify by type; set severity by business impact.
What it is
The incident response plan (IRP) sets out in advance how the organization detects, responds to and recovers from information security incidents: who does what, with what authority, and how decisions are escalated. Incident classification and categorization sort incidents by type and severity, so each gets the right level of response and the right people are involved.
How it works
Events and incidents
An event is any observable occurrence, such as a failed login. An incident is an event, or series of events, that harms or threatens the confidentiality, integrity or availability of information or systems, or breaks security policy. Triage decides which events are incidents.
Contents of the incident response plan
- Purpose, scope and definitions.
- Incident response team structure, roles, deputies and contact details, including legal, communications, HR and business representatives.
- Authority: who can declare an incident, isolate systems or shut down services.
- Classification and severity criteria.
- Escalation paths and time frames for each severity.
- Procedures for detection, analysis, containment, eradication and recovery, often with playbooks for common incident types.
- Evidence handling.
- Internal and external communication rules, including regulators, customers, law enforcement and media.
- Links to the business continuity and disaster recovery plans.
- Post-incident review and plan maintenance.
The plan is approved by senior management, aligned with the BCP and DRP, kept current and available when systems are down.
Team models
| Model | Note |
|---|---|
| Central team | One team for the whole organization |
| Distributed teams | Teams in different locations or business units, coordinated centrally |
| Outsourced or retainer | External incident response firm, often for forensics or surge capacity, contracted in advance |
Classification and categorization
| Dimension | Examples |
|---|---|
| Category (type) | Malware, unauthorized access, data breach, denial of service, insider misuse, loss of equipment |
| Severity | Based on business impact: data sensitivity, number of systems or people affected, effect on critical services, legal implications |
| Priority | How quickly to respond, from severity and urgency |
Severity criteria are agreed with the business in advance and linked to the BIA, so a team at 3 a.m. can classify consistently. Classification can change as more is learned; an incident that turns out to involve regulated data is reclassified and escalated.
When a question asks how to make sure serious incidents reach senior management quickly, look for defined severity criteria with matching escalation paths in the IRP.
How the exam asks about this
- "What determines incident severity?" Business impact, using criteria agreed in advance.
- "Who should be on the incident response team?" Security and IT, plus legal, communications, HR and business representatives as needed.
- "Responders were unsure who could shut down a service." The IRP must define authority.
What to remember for the exam
- Events become incidents when they harm or threaten information or break policy.
- The IRP defines roles, authority, escalation, procedures and communication.
- Classify by type; set severity by business impact.
- Severity criteria come from the BIA and are agreed in advance.
- Reclassify and escalate as facts emerge.
A plan that names people but not deputies, or exists only on the network it is meant to protect, fails when it is needed most.
Common mistakes
Treating every event as an incident. Triage first.
Rating severity by technical metrics only.
Leaving authority to act undefined.
Check yourself
What is the difference between an event and an incident?
An event is any observable occurrence; an incident harms or threatens information or systems or violates policy.
What should incident severity be based on?
Business impact, using criteria agreed with the business in advance.
Why should the IRP define authority?
So responders know who may take actions such as isolating systems or shutting down services without delay.
Topic 1 of 5 in Incident Management
Test yourself on Incident Management
The full ISACA CISM question bank has 1,044 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.