Which statement best distinguishes an event from an incident?

### Why this is right An event is an observable occurrence in a system or network, such as a user sending email. An incident is narrower: it is an adverse event in an information system or network, or the threat of such an event. ### The concept Events occur during ordinary system and network activity, so observing an event does not by itself prove that an incident has happened. The adverse nature of an occurrence, or a threat of an adverse occurrence, is what distinguishes an incident. Teams document and analyze observations to decide whether they should activate their response plan. ### The other options - **B. An event is always malicious; an incident is always harmless**: This reverses the definitions. Events can be ordinary, while incidents involve adverse effects or threats. - **C. An event occurs only on devices; an incident occurs only on networks**: Both definitions can apply to systems or networks; the distinction is not location. - **D. An event is a recovery action; an incident is a backup**: Neither term describes those actions or resources. ### Terms - **Event**: An observable occurrence in a system or network. - **Incident**: An adverse event in an information system or network, or the threat of such an event. ### Remember An incident is an adverse event or threat; not every observable event is an incident.