A security incident: a materialized threat. Response tasks live in the work model; who commanded the response comes from the role model. What is modeled here is the record auditors, regulators, and post-incident reviews need.