Skip to main content
MuonPartners
Services
Architecture

Solution design and technology roadmapping

Solution AssessmentTechnology RoadmapsIntegration DesignSolution ArchitectureTechnical Design
Cyber Security

Security assessments, IAM, and compliance

AssessmentsIAMComplianceSecurity BaselineCyber Innovation
Network and Platform

Network architecture and cloud platforms

Network DesignCloud StrategyModernisation
Enterprise Architecture

Business-technology alignment

Business AlignmentPortfolio AnalysisGovernance
View all services
ProjectsCase StudiesInsightsToolsAbout
Contact Us

Services

Architecture
Solution AssessmentTechnology RoadmapsIntegration DesignSolution ArchitectureTechnical Design
Cyber Security
AssessmentsIAMComplianceSecurity BaselineCyber Innovation
Network and Platform
Network DesignCloud StrategyModernisation
Enterprise Architecture
Business AlignmentPortfolio AnalysisGovernance
ProjectsCase StudiesInsightsToolsAboutContact
Get in Touch
MuonPartners

Strategic technology consulting for Australian organisations navigating complexity.

Services

  • Architecture
  • Cyber Security
  • Network and Platform
  • Enterprise Architecture

Company

  • About
  • Products
  • Frameworks
  • Cross-Framework Mapping
  • Projects
  • Case Studies
  • Insights
  • Contact

Contact

  • [email protected]
  • Australia
  • LinkedIn

© 2026 Muon Partners. All rights reserved.

ABN 50 669 022 315 · A Muon Group company.

Privacy PolicyTerms of Service
  1. Frameworks
  2. >C2M2
  3. >Event And Incident Response, Continuity Of Operations
  4. >Event And Incident Response, Continuity Of Operations - Objective 1
  5. >C2M2-RESPONSE-1C
C2M2-RESPONSE-1CActive

Cybersecurity events are documented based on the established criteria

Statement

Cybersecurity events are documented based on the established criteria

Location

Domain
Event and Incident Response, Continuity of Operations
Objective
Event and Incident Response, Continuity of Operations - Objective 1

Practice Details

Identifier
C2M2-RESPONSE-1C
Domain
Event and Incident Response, Continuity of Operations
Objective
Objective 1
Maturity Level
MIL-2

Help Text

Anything that is an event according to the criteria defined in RESPONSE-1b should be documented in a consistent manner. The organization should decide what details about events should be documented to enable, for example, (1) decisions about declaring events to be incidents, (2) collection of data for any event metrics the organization might be tracking, and (3) correlation of event information, if the organization is doing that.

Related Practices · Progression: This practice is part of a practice progression. Practice progressions are groups of related practices that represent increasingly complete or more advanced implementations of an activity. The practices in this progression include: RESPONSE-1a, RESPONSE-1b, RESPONSE-1c, RESPONSE-1f.

AESCSF
AESCSF-RESPONSE-1cequivalentvia derived-shared-practice-structure
View in graphReport an issue
← Back to Event and Incident Response, Continuity of Operations - Objective 1
Event and Incident Response, Continuity of Operations - Objective 16 controls
C2M2-RESPONSE-1ADetected cybersecurity events are reported to a specified person or role and documented, at least in an ad hoc mannerC2M2-RESPONSE-1BCriteria are established for cybersecurity event detection (for example, what constitutes a cybersecurity event, where to look for cybersecurity events)C2M2-RESPONSE-1CCybersecurity events are documented based on the established criteriaC2M2-RESPONSE-1DEvent information is correlated to support incident analysis by identifying patterns, trends, and other common featuresC2M2-RESPONSE-1ECybersecurity event detection activities are adjusted based on identified risks and the organization’s threat profile (THREAT-2e)C2M2-RESPONSE-1FSituational awareness for the function is monitored to support the identification of cybersecurity events