ISO/IEC 27000 has one term, information security incident, and ISO/IEC 27001 one process for all such incidents; ISO/IEC 20000-1 has several (incident, major incident, problem, known error, and its own information security incident), and an event can pass through several of its processes. Some events are security incidents but not service incidents (a confidential document left on a desk, a broken office lock), and some are service incidents outside the ISMS (maintenance exceeding SLA limits, a slow service), with the overlap being service-related events that lose confidentiality, integrity or availability. The organisation should decide how incidents that fall in both scopes are managed; both standards require analysis of incident data and trends; and defining and publishing criteria that let operations or service desk staff decide whether an incident is an information security incident gives more consistent classification.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.