Editing Information security (section)

=== Incident response plans ===
{{Main|Computer security incident management}}

Computer security incident management is a specialized form of incident management focused on monitoring, detecting, and responding to security events on computers and networks in a predictable way.<ref>{{cite web | title =ISO 17799{{!}}ISO/IEC 17799:2005(E) | work =Information technology - Security techniques - Code of practice for information security management | publisher =ISO copyright office | date =2005-06-15 | pages = 90–94 | url = http://www.iso.org }}</ref> 

Organizations implement this through incident response plans (IRPs) that are activated when security breaches are detected.<ref>{{Citation|last=Fowler|first=Kevvie|title=Developing a Computer Security Incident Response Plan|date=2016|url=http://dx.doi.org/10.1016/b978-0-12-803451-4.00003-4|work=Data Breach Preparation and Response|pages=49–77|publisher=Elsevier|doi=10.1016/b978-0-12-803451-4.00003-4|isbn=978-0-12-803451-4}}</ref> These plans typically involve an incident response team (IRT) with specialized skills in areas like penetration testing, computer forensics, and network security.<ref>{{Citation|last=Johnson|first=Leighton R.|title=Part 1. Incident Response Team|date=2014|url=http://dx.doi.org/10.1016/b978-1-59749-996-5.00038-8|work=Computer Incident Response and Forensics Team Management|pages=17–19|publisher=Elsevier|doi=10.1016/b978-1-59749-996-5.00038-8|isbn=978-1-59749-996-5|access-date=2021-06-05}}</ref>