Incident Management Overview is the ISACA CISM foundational governance framework that establishes how organizations detect, classify, escalate, and coordinate responses to information security incidents. In ISACA's precise vocabulary, an **event** is any observable occurrence in a system or network; an **incident** is an event that actually or potentially jeopardizes the confidentiality, integrity, or availability of an information asset, or violates security policy. Incident Management is the organizational capability—people, processes, and technology—to move systematically from event detection through post-incident review. At the Overview level, the focus is governance architecture: who holds authority to declare an incident, how severity (intrinsic threat level) differs from priority (business impact urgency), which stakeholders activate at which thresholds, and how the full lifecycle is governed before detailed response execution begins.
Where it stops · what it isn't
- —IS an ISACA CISM governance and lifecycle framework — NOT a technical incident response playbook or step-by-step forensic procedure guide
- —IS concerned with organizational roles, decision authority, escalation paths, and severity/priority classification — NOT investigation techniques, forensic tool usage, or eradication mechanics covered in sibling competencies
- —IS applicable to information security incidents affecting confidentiality, integrity, or availability — NOT general IT service incidents (e.g., printer outages) unless they carry a security dimension
- —IS distinct from Disaster Recovery Planning and Business Continuity Management — those activate when an incident exceeds the organization's recovery capability; Incident Management governs all incidents up to and including that threshold
- —IS NOT synonymous with ITIL Incident Management, which prioritizes service restoration speed; CISM Incident Management emphasizes security governance, evidence preservation, and compliance obligations alongside restoration
Connected concepts in the graph
Every cubelet sits in a knowledge graph. Here's what this one connects to.
PART OFISACA CISM Domain 4: Incident Management
ENABLESIncident Management and Response PlansIncident Classification and CategorizationIncident Investigation, Evaluation, Containment, and CommunicationIncident Eradication, Recovery, and Review
RELATED TOIncident Management Operations, Tools, and TechnologiesBusiness Impact and ContinuityDisaster Recovery Planning
REQUIRESInformation Security Governance (CISM Domain 1)
CONSTRAINSRegulatory Compliance and Breach Notification Obligations