What it means
An incident is a security situation that needs coordinated handling under your organization’s criteria. It may involve unauthorized access, lost availability, exposure of information, or a serious policy violation. An alert is a signal; declaring an incident is a decision about what that signal and other evidence mean for response. Initial facts can be incomplete. Teams should be able to start handling credible concerns without pretending that every detail is confirmed, then update severity, scope, and conclusions as evidence develops.
AN ILLUSTRATIVE SCENARIO
A school’s shared drive becomes unavailable
Teachers report that files have become unreadable and unfamiliar notes appear in several folders. The school activates its incident process while the technical team establishes what happened. A coordinator tracks decisions, an operations lead considers service continuity, and investigators preserve relevant records. They do not wait for every affected file to be counted before assigning ownership. They also avoid declaring all connected systems compromised without supporting evidence.
Put it to work
- Set practical incident criteria and reporting routes. Include human reports, supplier notifications, and service disruptions, rather than relying only on automated detections.
- Assign a coordinator, record known facts and open questions, and select an initial severity using business impact. Establish who approves containment and communicates with affected teams.
- Track containment, recovery, and verification separately. Preserve a decision timeline, update the scope as evidence changes, and turn lessons from the incident into owned improvements.
How to check your work
Review a practice case from report to closure. The record should show why it became an incident, who made important decisions, how affected services were verified, and which follow-up actions still have owners.
Connect the ideas
- Alert
A notification that a rule or model wants a human to look at one or more records.
- Triage
A short, time-boxed judgment of severity, uncertainty, and next action when an alert arrives.
- Evidence
A record you are willing to cite in a decision, with enough provenance to explain what it can prove.
- Impact
How badly people or the business are hurt if the loss actually happens.