Cybersecurity events are declared to be incidents based on established criteria

The cybersecurity incident declaration criteria established according to RESPONSE-2c are used to determine whether an event should be declared to be an incident. Declaring an incident initiates the incident response activities in RESPONSE-3.

Related Practices · Input From: Implementing RESPONSE-2c provides input that may be useful for implementing this practice. · Progression: This practice is part of a practice progression. Practice progressions are groups of related practices that represent increasingly complete or more advanced implementations of an activity. The practices in this progression include: RESPONSE-2b, RESPONSE-2d, RESPONSE-2f, RESPONSE-2i.