Incident Management
Plans, roles and tooling are ready before anything happens — so every later phase is faster.
Anyone can raise it; the record is opened. Classify it — grade severity and decide escalation.
The right people act, a decision log runs.
Secure and isolate before containment destroys it.
Meet reporting obligations: who, by when.
Learn: root cause and lessons become corrective actions.