“The organization shall plan and prepare for managing information security incidents by defining, establishing and communicating information security incident management processes, roles and responsibilities.” (ISO 27001 A 5.24)

A security incident is an actual or suspected occurrence that compromises—or could compromise—the confidentiality, integrity, or availability of information, information systems, or business services, or that violates security rules. Security incidents are prioritized with priority 1 (HIGH) (Priority Table ).