A structured approach to guide the development of incident management capability for security and privacy