Incident management: detection, response, mitigation, reporting, recovery, remediation, lessons learned

Incident management is the organized approach to handling security incidents so damage is limited, recovery is quick and the organization learns from each event. An event is any observable occurrence, such as a login or a file access. An incident is an event or series of events that actually or potentially jeopardizes confidentiality, integrity or availability, or violates policy. Not every event is an incident, and part of the process is making that call quickly and consistently.