What is incident management?
Detecting, responding to and recovering from events that disrupt normal operations, in a structured and practised way.
Handling the unexpected, on purpose.
An incident is an unplanned event that disrupts, or threatens to disrupt, an organisation’s people, services, assets or reputation. Incident management is the set of roles, plans and actions used to detect it, assess how serious it is, respond, communicate, recover and learn from it.
The aims are the same in every case: protect people first, limit the impact, restore critical services quickly, and keep the right people informed while it happens.
Eight common types.
Technology outage
A core system, network or cloud service fails, or a change to a system goes wrong.
Cyber attack or data breach
Ransomware, intrusion or data loss takes systems offline or exposes information.
Building or facility loss
Fire, flood, power or utility failure, or a security event makes a site unusable.
Loss of people
Illness, travel disruption, industrial action or the loss of key staff leaves teams unable to deliver.
Supplier or partner failure
A critical supplier, outsourcer or partner cannot deliver, or is hit by its own incident.
Natural hazard
Extreme heat, storms, flooding, earthquakes or other severe weather affect operations or staff.
Safety and security event
Threats to people on site, such as an emergency evacuation, intrusion or civil disturbance.
Health emergency
An outbreak or public health event affects staff, customers or the supply chain.
Six steps, at a general level.
Detect and report
Monitoring, alerts and people spot the event and report it quickly to a known contact point.
Assess and classify
Judge what is affected and how serious it is, and assign a severity level that decides who is involved.
Activate and respond
Bring in the incident team, follow the plan, contain the problem and protect people, systems and data.
Communicate
Keep staff, leaders, customers, regulators and partners informed with clear, timely and consistent updates.
Recover
Restore critical activities and services in priority order, using continuity and recovery arrangements where needed.
Review and learn
Hold a post-incident review, record what worked and what did not, and update plans, training and controls.
Throughout, a written incident log records what was known, what was decided and why. It supports decisions during the incident and the review afterwards.
How are incidents, accidents, emergencies and crisis events detected?
An incident is an unplanned event that disrupts operations. An accident causes harm or damage, an emergency needs immediate action to protect life, and a crisis threatens the organisation as a whole. All of them are usually first noticed in a handful of ways. The sooner they are noticed and reported to the right people, the more options the organisation has.
Monitoring and alerts
Systems, networks, security tools, building management systems and environmental sensors raise an alarm when readings move outside normal limits.
Physical alarms and sensors
Fire, smoke, gas, flood and intruder alarms, CCTV, access control and panic buttons detect events on site.
People
Staff, security guards, contractors, visitors and customers notice that something is wrong. Everyone needs to know how to report it quickly.
Service desk and customer contact
A spike in calls, complaints or failed transactions often shows an incident before the monitoring does.
Suppliers and partners
Notifications from outsourcers, cloud providers and critical suppliers about their own outages or incidents.
Authorities and external alerts
Weather warnings, civil defence and emergency service alerts, regulators, national cyber agencies and threat intelligence feeds.
Media and social media
News and social media monitoring can reveal a developing event or a reputational crisis. Check what you read before acting on it.
Audits, near misses and reviews
Internal checks, exercises, near-miss reports and trend analysis expose weaknesses and early warning signs before they become incidents.
Warning signs: precursors and indicators
Precursors
Signs that an incident may happen in future, such as a vulnerability scan against your systems, a severe weather warning or a supplier reporting trouble.
Indicators
Signs that an incident may have happened or may be happening now, such as an antivirus alert, a failed system check, an alarm or a report from a member of staff.
Precursors are rarely available, so responders usually see indicators first. Technical signs come from tools and logs, human signs come from reports by staff, customers and other organisations. Either way, someone has to judge whether the sign is real or a false alarm, which is why triage is the next step.
The terms precursor and indicator come from the NIST guidance on computer security incident handling (SP 800-61) and are used here more widely. Sources: NIST SP 800-61, Wikipedia: Incident management.
Making detection work
Make reporting simple
One agreed contact point and an easy way to raise the alarm, day and night.
Set clear triggers
Define what counts as an incident and when to escalate, so people do not wait for certainty.
Watch the right indicators
Track early warning measures for your most critical services, suppliers and sites.
Test the alerts
Exercise alert routes and call trees regularly, so they work when it matters.
Once an event is detected, it is reported, assessed and classified, and escalated if needed. See the six steps above.
When are incident management, incident response and business continuity plans activated?
Plans are activated when an event passes the thresholds the organisation has agreed in advance. Different plans start at different points, and each one usually builds on the one before.
Incident management or response plan
Activated first, as soon as an event is detected and confirmed as real. A duty manager or incident manager opens it, and the incident team starts to assess, contain and communicate. It covers cyber, safety, security and site emergencies.
Emergency plan
Activated at once when there is a threat to life or safety, such as a fire, evacuation or security threat. Protecting people comes before everything else, and the emergency services are called where needed.
Business continuity plan
Invoked when critical activities cannot continue as normal, or are expected to be unavailable for longer than the organisation can tolerate. Typical causes are the loss of a site, system, key supplier or large numbers of staff.
IT disaster recovery plan
Invoked when a technology service is down for longer than its agreed recovery time objective, or when the primary site or platform cannot be restored quickly.
Crisis management plan
Activated when the event threatens the organisation as a whole, such as its strategy, reputation, regulatory position or the safety of many people, and senior leaders must decide and speak for the organisation.
Impact on critical activities
Are important services stopped, or about to stop, and for how long?
Duration against tolerance
Is the outage expected to last longer than the recovery time objective, or the maximum disruption the organisation can accept?
Safety and people
Is anyone at risk, injured or unable to reach a safe place of work?
Scale and spread
Is the event growing, affecting more than one site, system, supplier or region?
Legal, regulatory and reputational exposure
Could it breach obligations, trigger a duty to notify, or attract media or public attention?
Instructions from authorities
Has a regulator, civil defence body or emergency service told you to act?
Good plans spell out these activation criteria, name who has the authority to activate them (with deputies for when they are away), and say how people are notified and mobilised. ISO 22301 expects an organisation to set impact thresholds that justify starting a formal response, so check the standard for the exact wording.
If in doubt, activate early. It is easier to stand a response down than to catch up with a problem that has grown. When the event is under control, the plans are stood down, normal operations resume, and a post-incident review captures what to improve.
How detection and activation work in practice.
These examples are simplified and general. Real procedures differ by organisation, service and country, so check your own plans and the guidance of your local authorities.
In business
A payment system outage at a bank
Monitoring alerts and a rise in failed transactions reveal the problem. The incident manager opens the incident plan. When the outage passes its recovery time objective, the IT disaster recovery plan and the business continuity plan are invoked, and the crisis team handles customers and the regulator.
A ransomware attack
A security tool alert and staff reports of locked files trigger the security incident response plan. Affected systems are isolated. If critical services stay offline, continuity and recovery plans start, and senior leaders manage communications and any legal or regulatory notification.
A fire alarm at an office
The alarm starts the emergency plan and an evacuation, and the fire service is called. If the building cannot be used afterwards, the business continuity plan moves critical teams to an alternative site or to remote working.
A key supplier failure
The supplier or the service desk reports delays. The incident team assesses the impact, the continuity plan switches to an alternative supplier or manual workaround, and a review improves supplier arrangements.
Emergency services and civil defence
Police
A control room receives calls through the emergency number, assesses them, gives each a priority and sends officers. When an event is too large for normal resources, a major incident is declared, a commander takes charge and other agencies are brought in.
Fire and rescue
An alarm or call leads to a pre-planned attendance sized to the risk. An incident commander takes control on scene, and more crews or specialist units are requested as the situation grows.
Ambulance services
Call handlers ask structured questions to prioritise each call, and crews are sent by priority. If casualties exceed normal capacity, a major incident plan is activated and casualties are sorted by urgency at the scene.
Civil defence and emergency management
Authorities issue early warnings, such as sirens or mobile alerts, coordinate evacuation and shelter, and run an emergency coordination centre that links the emergency services, other agencies and businesses.
Large events need several agencies to work together. In the UK, for example, the emergency services follow the Joint Emergency Services Interoperability Principles (JESIP): co-locate, communicate, coordinate, jointly understand risk and share situational awareness. Responders often use the METHANE message to pass on the first facts of a major incident: Major incident declared, Exact location, Type of incident, Hazards, Access, Number of casualties and Emergency services needed.
Businesses can learn from this. Clear priorities, a named commander, a simple way to escalate and a shared picture of what is happening work just as well in a company incident room as at a roadside.
Crisis command centres and virtual command centres.
A command centre, sometimes called an incident room, crisis room or emergency operations centre, is where the incident or crisis team meets to gather information, make decisions, direct the response and communicate. It can be a physical room, a virtual space, or a mix of both.
Physical crisis command centre
Layout
Everyone can see the display wall and each other. The chair sits where they can see all screens and teams, and note-takers are close to the chair.
Information displays
Map or site view, timeline of events, news and social media feed, and a status board of actions, owners and deadlines.
Communications
Landlines and mobile, conference bridge, radio where needed, email and mass notification, and a plan for when the network is down.
Power and resilience
Backup power, cooling and connectivity, and an alternative room if the building is affected.
Supplies
Logbooks, templates, contact lists, plans, maps, whiteboards, chargers, water and food for long shifts.
Security and access
Controlled entry, clear rules on who may enter, and confidentiality of discussions and documents.
Roles and shifts
Named roles with deputies, handover procedures, and rest rules so people can work for days if needed.
Regular testing
Check the room, screens and phones regularly, and use it in exercises so people know how it works.
Virtual command centre
A shared virtual room
A secure video bridge, a team chat channel and a shared incident log, so people in different places act on the same information.
A live status board
A shared dashboard or document showing issues, decisions, actions, owners and times, updated in real time.
Out-of-band tools
If corporate email, chat or video is down in the incident, you need separate tools, such as personal or third-party channels agreed in advance, a phone bridge and a printed contact list.
Access and security
Multi-factor access that works away from the office, controls on who can join, and care about confidential information on home or public networks.
Meeting rhythm
A fixed schedule of short check-ins, clear chairing, and agreed rules so the call does not become chaotic.
Time zones and shifts
Handover between regions and rest periods, so a global team can keep going for several days.
Examples
Emergency operations centres
Governments and cities run permanent centres that bring together emergency services, utilities and agencies during major events.
Gold, Silver and Bronze command (UK)
Emergency services use strategic (Gold), tactical (Silver) and operational (Bronze) levels, each with its own place to meet and decide. See also JESIP in the examples above.
Corporate crisis rooms
Banks, airlines, energy and technology firms keep dedicated rooms or virtual rooms for the crisis team, often with a standby room in another location.
COVID-19 and hybrid response
Many organisations moved crisis teams online in 2020, making virtual command centres a normal part of planning.
Need help designing a command centre or a virtual incident room, or training your team to use one? See Incident / Crisis Management consulting and incident response and crisis simulations.
Incident management in different fields.
The core idea is the same everywhere: find the problem early, bring the right people together, limit the harm and get back to normal. The vocabulary and tools change from field to field.
Emergencies and physical incidents
Real-time response to events such as fires, floods or safety events, which can last hours or days. Teams deal with the direct effects and with wider disruption, including media interest, often under an incident command structure with a named incident commander.
Critical infrastructure
Incidents can involve physical processes, safety systems and regulatory duties. They may be cyber, physical, human, natural or hybrid, and can cascade across connected sectors, so early detection, structured escalation and coordination matter.
IT service management
The goal is to restore normal service quickly, within agreed service levels, and to limit business impact. ITIL describes an incident as an unplanned interruption to, or reduction in the quality of, an IT service, including a component failure that has not yet affected the service.
Cyber and security incidents
A computer security incident response team analyses the intrusion, works out how far it reaches, and takes corrective action to contain the damage and recover.
Why incidents happen, not only what happened.
A good post-incident review looks beyond the last action before the event. The researcher James Reason separated active failures, the immediate and visible errors, from latent failures: earlier decisions and weaknesses higher up the organisation that stay hidden until something triggers them.
Active failures
The slips, lapses or mistakes of the people closest to the event. They are easy to see, but they are rarely the whole story.
Latent failures
Gaps in design, planning, resourcing or oversight that sit quietly until a trigger exposes them.
Root cause analysis
Asks why the controls did not stop the event, and looks at people, processes, culture and decisions together.
A blame-free review
Focuses on learning, so people speak up early and the right fixes are made to policies, plans and training.
Incident, major incident, crisis and disaster.
Incident
An event that disrupts or could disrupt normal operations. Usually handled by the responsible team using standard procedures.
Major incident or emergency
A serious event that needs escalation, extra resources and often the emergency services. Normal procedures are not enough on their own.
Crisis
A situation that threatens the organisation’s objectives, people or reputation and needs senior leaders to make decisions and speak for the organisation.
Disaster and continuity invocation
When critical activities cannot continue as normal, business continuity and IT disaster recovery plans are invoked to restore them within agreed limits.
Clear roles, clear levels.
Many organisations organise incident response in tiers, often called operational, tactical and strategic. Problems are solved at the lowest level that can handle them and escalated when the impact, duration or uncertainty grows.
Incident manager
Leads the response, sets priorities, assigns tasks and keeps the team focused on the objective.
Response and recovery teams
Technical, facilities, people and supplier specialists who contain the problem and restore services.
Communications lead
Prepares and approves updates for staff, customers, partners, regulators and the media.
Crisis or executive team
Senior leaders who take strategic decisions, approve major actions and protect the organisation’s reputation.
Logger or scribe
Records decisions, actions and timings, so the response can be reviewed and evidenced afterwards.
You do not have to start from scratch.
ISO 22301
The business continuity management system standard. It requires an incident response structure, with defined roles, responsibilities and communication, to respond to disruptions.
ISO 22320
International guidance on emergency management and incident response, covering command and control, information, cooperation and coordination.
BCI Good Practice Guidelines (GPG 7.0)
Describes how to design and enable incident response and continuity solutions, and how to exercise and validate them.
Sector and technical guidance
Examples include ITIL for IT service incidents and NIST and ISO/IEC 27035 for security incident handling. Check which requirements apply to your sector and regulator.
Incident management and business continuity.
Incident management deals with the first minutes, hours and days of a disruption. Business continuity management (BCM) prepares the strategies, plans and resources needed to keep critical activities running and to recover them. Crisis management gives leaders the structure to decide and communicate. Enterprise risk management helps decide which incidents are most likely and most costly, so preparation goes where it matters.
Prepared
Plans, roles, contact lists and playbooks exist before the incident starts.
Practised
Exercises and simulations build the habits and confidence that a plan alone cannot.
Improved
Each incident and exercise feeds lessons back into plans, training and controls.
Read more: What is business continuity?, What is operational resilience?, What is enterprise risk management? and incident response and crisis management simulations.
The words you will hear.
Severity level
A simple scale, such as low, medium, high or critical, that decides who responds and how fast.
Escalation
Passing an incident to a more senior or specialist team when its impact, duration or complexity grows.
Incident log
The running record of facts, decisions, actions and timings during an incident.
Playbook
A short, practical guide for a specific kind of incident, with first actions, owners and contacts.
Impact tolerance
The maximum disruption to an important service that the organisation is willing to accept.
Invocation
The formal decision to activate a continuity, recovery or crisis plan.
Post-incident review
A blame-free look back at what happened, what worked and what to change.
Single point of contact
The agreed way to report an incident, so nothing is missed or handled twice.
What good incident management looks like.
A simple, known plan
People can find the plan, understand it quickly and know their own role when stress is high.
Fast, honest communication
Updates are frequent, factual and consistent, and say what is not yet known.
Practised regularly
Teams rehearse realistic scenarios. ADVOX designs business continuity exercises and incident response and crisis management simulations around an organisation’s own risks.
Learning built in
Every incident ends with a review, and actions are tracked until they are done.
The incident response lifecycle.
From preparation and detection to containment, eradication, recovery and lessons learned, summarised in one picture.
Talk to ADVOX about incident management and response.
We aim to reply to your enquiry within 2 hours during working hours.
Further reading: The Business Continuity Institute | NIST Computer Security Resource Center | Wikipedia: Incident management