Cybersecurity events are declared to be incidents based on established criteria
Context and Guidance: The cybersecurity incident declaration criteria established according to RESPONSE-2c are used to determine whether an event should be declared to be an incident. Declaring an incident initiates the incident response activities in RESPONSE-3.
Related Practices • Input From: Implementing RESPONSE-2c provides input that may be useful for implementing this practice. • Progression: This practice is part of a practice progression. Practice progressions are groups of related practices that represent increasingly complete or more advanced implementations of an activity. The practices in this progression include: RESPONSE-2b, RESPONSE-2d, RESPONSE-2f, RESPONSE-2i.