Incident is an adverse event or a situation that has the potential to or already has caused damage of some type.

Incident Mgmt plan of action Prepare Protect Detect Triage Respond Incident Response Plan Preparation - Make sure systems are in place Identification - Verify incident occurred - Classify & qualify event - Establish chain of custody Containment - Conduct assessment - Activate Mgmt response team - Agree on actions that will be taken - Gather and preserve evidence Eradication - Find the root cause - Remove root cause of event - Improve defense - Update or improve security measures Recovery - Perform the restore of effected data or devices - Validate restore actions - Test systems to ensure they are functioning correctly - Receive signoff that the system(s) are working correctly Analysis - Lessons learned - Improve the process for future use