A data security incident means that there was a gap, or multiple gaps, in the security of your organizational systems. The IR process includes investigating the security gaps that led to that incident and a good IR will provide recommendations for closing the gaps. Measures can include company-led anti-phishing awareness and training, updating system versions and even updating the company’s firewall to block rogue IPs.