An ICT incident is a disruption or degradation of information and communication technology services, such as networks, applications, servers, identity systems, or cloud platforms. It can range from a brief service slowdown to a major outage that affects business operations, data access, or communication channels.
In cyber security, the term matters because many attacks are first seen as ICT incidents: ransomware can encrypt systems, DDoS can degrade availability, and misconfigurations or failed updates can also trigger service loss. Defenders use incident detection, classification, and escalation to decide how serious the event is, who must respond, and whether reporting obligations apply. Good handling means more than recovery; it also includes logging, containment, root-cause analysis, and clear documentation so the organization can explain what happened and restore services safely.