olemus
ISO 22300, 22320:
toimingud ähvardava ohu põhjuste peatamiseks,
ja/või destabiliseerida või halvata võivate sündmuste tagajärgede
leevendamiseks ning normaalse olukorra taastamiseks
= actions taken in order to stop the causes of an imminent hazard and/or mitigate the consequences of potentially destabilizing events or disruptions, and to recover to a normal situation

ISO/IEC 27035:
toimingud infoturvaintsidendi
leevendamiseks või lahendamiseks,
infosüsteemide ja neis oleva teabe
normaalsete tingimuste kaitseks ja taasteks
= action taken to protect and restore the normal operational conditions of information systems and the information stored in it when an attack or intrusion occurs

ISACA Glossary:
ettevõtte reageerimine avariile või muule
olulisele sündmusele, mis võib tunduvalt mõjutada
ettevõtet, ta töötajaid, ta tootliku töö võimet;
reageerimine võib hõlmata evakueerimist territooriumilt,
toibumisplaani täitmise käivitamist,
kahjustuste hindamist,
muid ettevõtte seisundi stabiliseerimise meetmeid
= the response of an enterprise to a disaster or other significant event that may significantly affect the enterprise,itspeople,or its ability to function productively;
an incident response may include evacuation of a facility, initiating a disaster recovery plan, performing damage assessment, and any other measures necessary to bring an enterprise to a more stable status.

ülevaateid
https://raw.githubusercontent.com/swannman/ircapabilities/master/hierarchy.png

http://media.techtarget.com/searchNetworking/Downloads/IncidentResponseChapter2.pdf

http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf

http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-86.pdf

http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-83r1.pdf

http://www.cybersecurity-review.com/incident-response-plans-a-comparison-of-us-law-eu-law-and-soon-to-be-eu-law/

https://www.giac.org/paper/gsec/3907/introduction-computer-security-incident-response/106281

ENISA
https://www.enisa.europa.eu/publications/cyber-incident-reporting-in-the-eu/at_download/fullReport

https://www.enisa.europa.eu/publications/good-practice-guide-for-incident-management/at_download/fullReport

https://www.enisa.europa.eu/publications/actionable-information-for-security
https://www.enisa.europa.eu/publications/strategies-for-incident-response-and-cyber-crisis-cooperation/at_download/fullReport
https://www.enisa.europa.eu/act/rm/cr/bcm-resilience/bc-plan/incident-response-plan

vt ka
- intsidendihaldus
- intsidendikäsitlus
- intsidendiplaan
- intsidendi valitsemine