Incident Response is the process of responding to and handling ICT security related incidents involving infrastructure and
data. This has traditionally been a reactive approach, focusing mainly on technical issues. In this paper we present the Incident
Response Management (IRMA) method, which combines traditional incident response with pro-active learning and socio-technical
perspectives. The IRMA method is targeted at integrated operations within the oil and gas industry.