According to ISO/IEC 27000:2018, which provides an overview and vocabulary of information
security management systems, an information security event is an identified occurrence of a system,
service or network state indicating a possible breach of information security policy or failure of
safeguards, or a previously unknown situation that may be security relevant1. An information
security incident is a single or a series of unwanted or unexpected information security events that
have a significant probability of compromising business operations and threatening information
security1. Therefore, based on this definition, three examples of information security incidents are:
A contractor who has not been paid deletes top management ICT accounts: This is an example of an
unwanted or unexpected information security event that has a significant probability of
compromising business operations and threatening information security, as it may result in loss of
access, data, or functionality for the top management.
An unhappy employee changes payroll records without permission: This is an example of an
unwanted or unexpected information security event that has a significant probability of
compromising business operations and threatening information security, as it may result in financial
fraud, legal liability, or reputational damage for the organization.
The organisation’s marketing data is copied by hackers and sold to a competitor: This is an example
of an unwanted or unexpected information security event that has a significant probability of
compromising business operations and threatening information security, as it may result in loss of
confidentiality, competitive advantage, or customer trust for the organization.
The other options are not examples of information security incidents, but rather information security
events that may or may not lead to incidents depending on their impact and severity. For example:
The organisation’s malware protection software prevents a virus: This is an example of an identified
occurrence of a system state indicating a possible breach of information security policy or failure of
safeguards, but it does not have a significant probability of compromising business operations and
threatening information security, as it is prevented by the malware protection software.
A hard drive is used after its recommended replacement date: This is an example of an identified
occurrence of a system state indicating a possible breach of information security policy or failure of
safeguards, but it does not have a significant probability of compromising business operations and
threatening information security, unless it fails or causes other problems.
The organisation receives a phishing email: This is an example of an identified occurrence of a
network state indicating a possible breach of information security policy or failure of safeguards, but
it does not have a significant probability of compromising business operations and threatening
information security, unless it is opened or responded to by the recipient.
An employee fails to clear their desk at the end of their shift: This is an example of an identified
occurrence of a service state indicating a possible breach of information security policy or failure of
safeguards, but it does not have a significant probability of compromising business operations and
threatening information security, unless the desk contains sensitive or confidential information that
is accessed by unauthorized persons.
The organisation fails a third-party penetration test: This is an example of an identified occurrence of
a system state indicating a possible breach of information security policy or failure of safeguards, but
it does not have a significant probability of compromising business operations and threatening
information security, unless the penetration test reveals serious vulnerabilities that are exploited by
malicious actors.
Reference: ISO/IEC 27000:2018 - Information technology – Security techniques – Information
security management systems – Overview and vocabulary
