What it means
An incident is a security situation that needs coordinated handling under your organization’s criteria. It may involve unauthorized access, lost availability, exposure of information, or a serious policy violation. An alert is a signal; declaring an incident is a decision about what that signal and other evidence mean for response. Initial facts can be incomplete. Teams should be able to start handling credible concerns without pretending that every detail is confirmed, then update severity, scope, and conclusions as evidence develops.
The idea at a glance / Response
One confirmed loss; unfinished response.
Hold verified unauthorized disclosure beside the incident decision and still-open response work.
Independent synthetic application checks return staffing row F112 to caller U112 as X112 with HTTP 200, although authoritative policy P112 denies that caller access to F112. The application omitted the required permission check. Vera Vance applies Chronos Hub’s criterion for verified unauthorized disclosure and declares INC112 for this file. The original remains; wider scope, cause and response are unfinished.
READ THE PICTURE
Declared and open
Vera declares INC112 after the unauthorized F112 copy is independently verified. Kael’s containment work and Vera’s wider-scope review remain pending.
Keep in mindThis proves one controlled unauthorized copy under assumed valid session, policy and observation evidence. It does not identify the human, establish malicious intent, count every affected file or settle notification duties. An incident can also involve imminent harm or a serious policy violation. Declaration does not complete containment, recovery or closure; this exercise uses no real personal data.
Read the complete example
- Declared and open. Vera declares INC112 after the unauthorized F112 copy is independently verified. Kael’s containment work and Vera’s wider-scope review remain pending. F112 contains entirely synthetic driver D112, homeAddress 12 Example Lane and clearance eligible. P112 is the authoritative selected read policy and denies U112. The controlled application nevertheless delivers an independent unchanged copy X112 with HTTP 200 because its route omits that check. An ordinary permitted reader still receives the row. The original survives, so loss of confidentiality need not remove it. Chronos Hub’s fictional criterion treats this verified unauthorized disclosure as an incident and assigns Vera Vance. INC112 records the evidence and narrow scope. Kael Cho has containment work assigned, but no access has yet been revoked; Vera’s wider-scope and notification review is also unfinished. Root cause beyond the observed missing gate, human attribution, earlier activity, operational consequences and final closure are not established.
This proves one controlled unauthorized copy under assumed valid session, policy and observation evidence. It does not identify the human, establish malicious intent, count every affected file or settle notification duties. An incident can also involve imminent harm or a serious policy violation. Declaration does not complete containment, recovery or closure; this exercise uses no real personal data.
Diagram references: NIST SP 800-61 Rev. 3: incident criteria and triage
AN ILLUSTRATIVE SCENARIO
A verified copy and an open incident
Controlled checks deliver synthetic F112 to U112 despite P112 denying that access. X112 contains the same row while the original remains. Sloane applies Meridian’s verified-disclosure criterion and declares INC112 for the selected file. Vera’s containment work, broader scope and notification review remain open. This is an observed authorization failure in an isolated exercise, not proof about a real person or every file in the service.
Put it to work
- Set practical incident criteria and reporting routes. Include human reports, supplier notifications, and service disruptions, rather than relying only on automated detections.
- Assign a coordinator, record known facts and open questions, and select an initial severity using business impact. Establish who approves containment and communicates with affected teams.
- Track containment, recovery, and verification separately. Preserve a decision timeline, update the scope as evidence changes, and turn lessons from the incident into owned improvements.
How to check your work
Review a practice case from report to closure. The record should show why it became an incident, who made important decisions, how affected services were verified, and which follow-up actions still have owners.
Connect the ideas
- Alert
A notification that a rule or model wants a human to look at one or more records.
- Triage
A short, time-boxed judgment of severity, uncertainty, and next action when an alert arrives.
- Evidence
A record you are willing to cite in a decision, with enough provenance to explain what it can prove.
- Impact
How badly people or the business are hurt if the loss actually happens.