vPLfv

2.5 Applying These Incident Management Concepts
and Processes
The basic principles put forth in this report are that incident management processes are distributed
in nature and should
• be enterprise driven
• have defined roles and responsibilities to ensure accountability
• have defined interfaces and communication channels with supporting policies and procedures
for coordination across processes and process actors
• be integrated into other business and security management processes
The incident management processes described in this report can be used as a framework to
help an organization meet the principles listed above.
This framework requires a best practice process model for incident management. That is what
we have begun to develop with our new work. This report documents the initial details of that
model. To develop this best practice incident management process model, we identified the
processes, as described before, outlined each process via a workflow diagram, and provided
the details and requirements of each process in a corresponding workflow description table.
In the following sections (3 and 4), we describe our incident management processes model in
detail. The majority of the work is presented through figures called workflow diagrams that
map the flow of incident management actions. These workflow diagrams and their supporting
workflow descriptions and handoffs are included in Section 4, “Incident Management Process
Workflows and Descriptions.” An example of a workflow is show in Figure 6. A readable
version of the figure can be found in Section 4.2.3.4, “D: Detect Events Workflow Diagram.”
Figure 6
Example of an Incident Management Workflow Diagram
CMU/SEI-2004-TR-015 27