Information Security Incidents

According to ISO/IEC 27001, information security incidents are defined as:

"A single or a series of unwanted or unexpected information security events that have a significant probability of compromising business operations and threatening information security"

Information security incidents should be monitored and recorded in order to eliminating them. This includes recording: 

• The detection of incident
• The cause of the incident
• Procedures used to ensure that the problem has been eradicated
• Collections of evidence (if needed for future lawsuits)

The next step is to figure out a way of preventing the incident from recurring. This step includes:

• Actions needed to prevent recurrence
• Estimated cost

The results of this step should be presented to the management in order to determine if preventing actions should be taken.