IR-5 Detection and analysis - prioritize incidents
Give security operations the context to prioritise incidents, combining alert severity with the sensitivity of the affected asset as defined in the incident response plan.
4
artefacts
1
held by a system
1
at each review
moderate
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Triage records showing the priority assigned and why · Document repository
periodic reviewEvidence produced at each review
- Review of whether priority matched actual impact · Document repository
governing documentDocuments that govern the control
- Asset criticality or sensitivity tagging visible to responders · Document repository
- Documented prioritisation matrix combining severity and asset value · Policy repository / GRC workspace
First move
Start with the 1 of 4 artefacts that already live in a system (Document repository); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- prioritisation on alert severity alone so a critical asset is treated like a test box
- criticality data exists in a register responders cannot see
- matrix defined but not applied in practice
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetIR-4 Detection and analysis - investigate an incident · IR-6 Containment, eradication and recovery - automate the incident handling