Iliana Peters of the law firm Polsinelli says the term "security incident" as defined in the new rule refers to an event that "actually or imminently" jeopardizes the integrity, confidentiality or availability of information systems or "constitutes a violation or imminent threat of violation" of security procedures and policies.