Incident Management and Incident Response Overview

Figure 9.1: Incident management

Incident management is defined as the process of handling disruptive events in a structured manner to minimize their impact on business processes. In most organizations, the responsibility for developing and testing incident management lies with the information security manager.

The Relationship between Incident Management and Incident Response

An information security manager needs to understand the difference between incident management and incident response. Incident management encompasses the entire process of managing any incident, which includes planning, testing, communicating, documenting, reviewing, approving, and allocating different tasks for the successful management of the incident.

Incident response includes only those activities that are performed when responding to an incident and focuses on the identification, triage, containment, eradication, and recovery...