Incident Management Mission Diagnostic Method, Version 1.0 - Cert

WHAT IS AN IMC?
An incident management capability (IMC) can take many forms.
Usually, in government, education, and commercial organizations,
parts of this function are performed across a number of business
functions or departments that can include security or information
technology (IT) operations, risk management, human resources, or
legal investigative units. Some organizations have a core team,
generally referred to as a computer security incident response team
(CSIRT) 2 , that focuses on specific parts of the incident management
process, particularly the coordination of response activities. This
CSIRT may be ad hoc, virtual, or a formally defined, dedicated group
of personnel. Whatever its organizational model, the team works with
other parts of the organization, contractors, or other outsourced service
providers to perform successful incident management. The services
provided by an IMC are provided to its customers, called the
constituency 3 .
For the purposes of this document, the term IMC will be used to
represent all of the groups of people who perform incident
management activities for an organization.
2
3
CSIRT is a generic term for organizational entities whose main purpose is to detect, analyze, prevent, and respond
to computer security incidents and vulnerabilities. Such entities may use names and acronyms such as
computer emergency response team (CERT), computer incident response team (CIRT), security incident response
team (SIRT), and other such names. What are typically considered CSIRT functions may also be performed
as one activity within a broader enterprise security or risk management function such as a resiliency team
or crisis-management team.
The constituency is the group to which the CSIRT or incident management capability provides services. For example,
the constituency for a CSIRT in a government organization would be the employees and possibly the clients
of the agency.
4 | CMU/SEI-2008-TR-007