Critical Incident

Overview

A critical incident exceeds normal operational handling because its potential impact, urgency, complexity, or public significance is exceptionally high. Examples include major asset theft, prolonged service outage, widespread data exposure, key compromise, or systemic payment failure.

Classification should use predefined criteria covering financial loss, affected customers, safety, legal duties, service dependency, spread, and recovery time. An event may be escalated before all facts are known because delayed coordination can increase harm.

Response requires empowered leadership, clear roles, secure communication, evidence preservation, technical containment, business continuity, and stakeholder decisions. Teams should maintain status records, reassess severity, meet notification duties, and conduct a formal review after stabilization.

A critical incident is a severe event requiring immediate coordinated response because it threatens essential services, assets, people, compliance, or organizational survival. Critical Incident should distinguish an alert, suspected event, confirmed incident, material impact, and restored service because each state requires different decisions and notifications. Critical Incident must define the affected service or asset, event severity, business and customer impact, evidence, responsible roles, containment priority, recovery objective, and reporting obligations. Critical incidents demand rapid executive and technical coordination, while evidence, communication, continuity, and legal obligations remain controlled under pressure.

A production treatment of Critical Incident should test the use of it threatens essential services, assets, people, compliance, or organizational survival within the relevant asset, decision, or service state. The Critical Incident context record for it threatens essential services, assets, and people should preserve source data, configuration or policy version, responsible actor, exception, and outcome. Review of Critical Incident should determine whether safeguards addressing it threatens essential services, assets, and people changed exposure in practice, not merely whether a document or setting existed.