5. Recovery. This phase involves bringing the business and assets involved in the security
incident back to normal operations.
6. Lessons learned. A thorough review of how the incident occurred and the actions
taken to respond to it where the lessons learned get applied to future incidents.
When a threat becomes a valid attack, it is classified as an information security
incident if [21]
• It is directed against information assets.
• It has a realistic chance of success.
• It threatens the confidentiality, integrity, or availability of information assets.