The important objective of the IMM is to provide a standard incident handling procedures. When an exploit occurs, security analysts feel panic and easy to make mistake when under pressure. If there is a well-defined incident handling procedure, the security analysts can stay calm to follow the procedures. Furthermore, security analysts usually handle incidents based on their previous experience and knowledge. It means that, different security analysts may have different approaches when dealing with the same incident. For example, analyst A takes 10 steps while analyst B takes 5 steps. It is difficult to ensure no missing steps in handling incidents. Thus, it is important to control and manage the incident management process. MindStorm provides a platform for enterprise to follow a standard workflow by Standard Operating Procedures, or simply called SOP. Everyone in the enterprise can follow the SOP to handle incidents to keep a consistent and high quality incident response.