Topics in this domain
- Event vs Incident vs Breach
- Developing the Incident Response Plan
- Incident Response Team Roles and Authority
- Incident Classification and Severity Levels
- Incident Response Playbooks and Decision Trees
- Escalation and Communication Plans
- Business Impact Analysis
- RTO, RPO, MTD and Recovery Prioritisation
- Business Continuity Planning and Strategies
- Crisis Management and Continuity Governance
- Disaster Recovery Planning
- Recovery Sites: Hot, Warm and Cold
- Backup Strategies and Cloud DR
- Incident Response Training
- Testing Plans: Tabletop, Functional and Full Interruption
- Evaluating Exercises and Improving Readiness
- Security Event Detection and Monitoring Methods
- SIEM, the SOC and Event Correlation
- Threat Intelligence and Indicators of Compromise
- Incident Triage and Initial Investigation
- Evidence Preservation, Forensics and Chain of Custody
- Containment Strategies: Short-Term and Long-Term
- Making Containment Decisions
- Breach Notification and Regulatory Reporting
- External Communications: Customers, Media and Law Enforcement
- Eradication, Recovery and Return to Normal Operations
- Post-Incident Review and Root Cause Analysis
- Lessons Learned and Incident Trend Analysis
Event vs Incident vs Breach
Getting the words right
Security teams see millions of events a day. A handful are incidents, and very few are breaches. Using the words precisely decides who gets woken up, which plans start, and when legal deadlines begin. Domain 4, Incident Management, is 29% of the exam (in the 2026 outline), covering readiness (plans, BIA, BCP, DRP, classification, testing) and operations (detection, investigation, containment, communication, recovery and review).
Three levels
| Term | Meaning |
|---|---|
| Event | Any observable occurrence in a system or network: a login, a file access, an alert |
| Security incident | An event or series of events that harms, or threatens to harm, confidentiality, integrity or availability, or violates policy |
| Data breach | An incident where protected data is confirmed to have been accessed, disclosed, altered or lost without authority |
Examples
| Situation | Classification |
|---|---|
| A user mistypes a password twice | Event |
| 10,000 failed logins against one account | Event; possibly an incident (brute force) |
| Malware found on a laptop and contained | Incident |
| Ransomware encrypts file servers | Major incident |
| An attacker exfiltrates customer records | Incident and data breach |
Why the distinctions matter
- Escalation: incidents trigger the response plan; events usually don’t.
- Legal clocks: breach notification deadlines (such as 72 hours under GDPR) usually start at awareness.
- Resources: major incidents bring in executives, legal and communications.
- Evidence: incidents may need forensic preservation from the start.
Declaring something a “breach” has legal meaning, so legal counsel should be involved before that word is used formally.
Example. An analyst sees unusual outbound traffic and records it as an event. A day later, legal learns it was customer data leaving the network. Because the incident was classified late, the company has less than 24 hours left of GDPR’s 72-hour window.
Incident management vs continuity
- Incident management: detect, contain, eradicate, recover and learn.
- Business continuity: keep critical business processes running during disruption.
- Disaster recovery: restore IT systems and data.
A major incident, such as ransomware, can trigger all three, so the plans must link to each other.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Any observable occurrence | An event |
| Harm or threat to confidentiality, integrity or availability | A security incident |
| Confirmed unauthorised access to protected data | A data breach |
| Why classify quickly? | Escalation and legal deadlines |
| Main goal of incident management | Limit damage and restore normal operations |
In short
- An event is any observable occurrence; most are harmless.
- A security incident is an event or series of events that harms, or threatens to harm, confidentiality, integrity or availability.
- A data breach is an incident where protected data is confirmed to have been accessed, disclosed or lost without authority; it often triggers legal notification duties.
- Clear definitions decide what gets escalated, who is involved and which clocks start, such as GDPR's 72 hours.
- Incident management aims to limit damage and restore normal operations; business continuity keeps critical processes running during major disruption.
- Domain 4 is 29% of the exam: readiness (plans, BIA, BCP, DRP, classification, testing) and operations (detect, investigate, contain, communicate, recover, review).
Exam traps
- Not every event is an incident, and not every incident is a breach.
- Calling something a 'breach' too early can trigger legal consequences; involve legal before declaring one.
- The notification clock usually starts at awareness of a breach, so classification must be quick.
- Incident response and business continuity are linked but different plans.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Three levels
1 / 9