Incident Management (IcM)

All activities of a SIPPAR to identify, analyze, and correct hazards to prevent future re-occurrence. These incidents within a structured SIPPAR are normally dealt with by either an incident response team (IRT) or an incident management team (IMT). These are often designated beforehand or during the event and are placed in control of the SIPPAR whilst the incident is dealt with to restore normal functions.

Similar to an IRT or IMT is an Incident Command System (ICS). Although some of the details vary by jurisdiction, ICS normally consists of five primary elements: command, operations, planning, logistics, and finance/administration. Several special staff positions, including public affairs, safety, and liaison, report directly to the incident commander (IC) when the emergency warrants establish those positions.

An incident is an event that could lead to loss of, or disruption to, a SIPPAR's operations, services, or functions. If not managed, an incident can escalate into an emergency, crisis, or disaster. Incident management is, therefore, the process of limiting the potential disruption caused by such an event, followed by a return to business as usual.

Without effective incident management, an incident can rapidly disrupt business operations, information security, IT systems, employees or customers, and other vital business functions.

Usually, as part of the wider management process in SIPPAR, incident management is followed by post-incident analysis, where it is determined why the incident happened despite precautions and controls. This analysis is normally overseen by the leaders of SIPPAR, with the view of preventing a repetition of the incident through precautionary measures and often policy changes. This information is then used as feedback to develop further the security policy and/or its practical implementation. In the United States, the National Incident Management System, developed by the Department of Homeland Security, integrates effective practices in emergency management into a comprehensive national framework. This often results in a higher level of contingency planning, exercise, training, and an evaluation of the incident's management.