A security event is an observable occurrence involving information systems, such as a login attempt or configuration change. Cybersecurity events provide evidence for monitoring and analysis, including ordinary activity and activity requiring investigation.
A security incident involves actual or imminent compromise of confidentiality, integrity, or availability, or violation or threatened violation of security requirements. Incidents can require response before data theft occurs, including misuse of privileged access or an attack disrupting service.
A data breach involves compromised data, such as improper access or disclosure; the applicable legal definition determines additional covered circumstances. Personal-data breaches can also involve destruction, loss, or alteration, so an availability failure can require breach analysis.
Classification follows the established facts.
Intent describes how a data breach occurred. Error or negligence can cause unintentional exposure, while malicious conduct produces intentional exposure. Neither intent nor an incident's internal severity rating independently determines whether a particular notice is required.
KEY: A blocked action does not automatically rule out an incident. Examine the surrounding compromise, threatened harm, and security requirements before classifying the occurrence.
Common mistakes
- Wrong policy version. A later, more permissive notification window cannot retroactively cure failure under the policy applicable when the incident occurred.
- Containment mistaken for eradication. Disabling a connection leaves removal of compromised credentials or persistence to be verified.
- Draft mistaken for delivery. A prepared notice lacks evidence that the required recipient received it through the specified channel.
Bottom line
- Cybersecurity events require classification from surrounding facts; incidents can exist without completed theft, and data breaches can be intentional or unintentional.
- Incident response plans assign authority, roles, alternates, methods, communication duties, evidence handling, timelines, and improvement responsibilities.
- Containment limits harm, eradication removes the cause, and recovery restores trusted service while analysis and learning continue.
- Evidence preservation addresses volatile information, protected records, forensic copies, integrity checks, timestamps, and chain of custody.
Exam shortcut
Classify from the strongest established fact: ordinary activity, threatened or actual compromise, or compromised data. A reassuring label such as “blocked” cannot replace that assessment. For timing questions, identify the recipient first, then locate the governing trigger. Mark the awareness or discovery time separately from the alert, declaration, and investigation-completion times. For compliance questions, locate the effective policy version before calculating elapsed time.
The full lesson (about 5,205 words, 35 min read) adds 2 worked examples, all 5 common mistakes, a self-check, free in the app.
Learning objectives
- II.D1
Browse all free CPA ISC lessons or jump into free CPA ISC practice questions.