Incident response plan and incident management team structure

An incident is an event that threatens the confidentiality, integrity or availability of information or systems, or violates security policy. Incident management is the capability to prepare for, detect, respond to and recover from incidents in a way that limits harm to the business. The incident response plan (IRP) is the document that makes this capability repeatable, so that under pressure people know what to do, who decides and whom to call. In CISM terms, the main purpose of the plan is a timely, coordinated response that minimizes business impact.