Manage security incidents

Coordinate evidence preservation, containment, service continuity, investigation, communication, recovery, and follow-up through named human decision-makers.

Field	Value
Business area	security-continuity
Primary role	it-security-administrator
Frequency	event-driven
Privacy sensitivity	high
Security sensitivity	high
Compliance review	needed

Trigger and handoff

Trigger: An authorized incident lead declares a suspected or confirmed security incident.

Inputs

• Triage evidence and scope
• Incident plan and contacts
• Critical service and legal context

Outputs

• Controlled incident timeline and decisions
• Contained and recovered services
• Required notifications and corrective actions

Current manual methods

• Group chat
• Ad hoc calls
• Vendor-led response

Human judgment and approvals

• Balance containment

• safety

• privacy

• evidence

• and continuity

• Reassess scope and decide when expert help is required

• Approval: Incident commander approves major actions; legal and accountable executives approve regulated communications

Failure modes

• Containment destroys evidence or safety fallback
• Public communication precedes verified facts

Success metrics

• Decisions and evidence remain traceable
• Recovery criteria and corrective actions are explicitly accepted