3. Security Impact

Security events break customer trust in us; being good at information security, is about preserving customer trust. Many events have a customer or security impact, and this process makes a point of treating them equally.

Security events are a special class of event, in that they may have downstream, unknown or unintended consequences that weren't clear at the original time of the event, or the time when the post-mortem analysis is completed. They may have their own process and team involved in the incident separately. CoE helps that work.

If there was no impact, then "There was no security impact." is sufficient; but care should be taken, especially with internet or customer facing systems.

If we define Security as Confidentialty, Integrity and Availability, was there definitely still no impact?