Cybersecurity incident declaration criteria are formally established based on potential impact to the function

Each organization has many unique factors that must be considered in determining when an event should be declared to be an incident. Through experience, an organization may have a baseline set of types of events that define standard incidents, such as a virus outbreak, unauthorized access to a user account, or a denial-of-service attack. However, in reality, incident declaration may occur on an event-by-event basis. To guide the organization in determining when to declare an incident (particularly if incident declaration is not immediately apparent), the organization must define incident declaration criteria. Incident declaration criteria should include factors that indicate the potential impact to the function, such as: • potential safety impacts • functional impact (priority and scope of impacted assets) • information impact (impact to information assets) • recoverability from the incident (resources necessary to recover from the incident) • the potential cause of the incident (malicious activity vs. unintentional actions) Additionally, incident declaration criteria should consider impact to the organization's cybersecurity goals, such as: • potential financial loss • number of customers affected • outage of major IT system • theft of customer information

Related Practices · Progression: This practice is part of a practice progression. Practice progressions are groups of related practices that represent increasingly complete or more advanced implementations of an activity. The practices in this progression include: RESPONSE-2a, RESPONSE-2c, RESPONSE-2e, RESPONSE-2h.