Has your organization established and documented incident alert thresholds that trigger appropriate response actions?

Incident alert thresholds define the specific conditions or metrics that, when reached or exceeded, trigger a security incident response. These thresholds should be established for various security monitoring systems (e.g., SIEM, IDS/IPS) and cover different types of events such as failed login attempts, unusual network traffic patterns, or data exfiltration attempts.

Evidence of this control could include a documented incident response plan that clearly defines alert thresholds for different severity levels, configuration screenshots of security monitoring tools showing threshold settings, or runbooks that detail the specific metrics and conditions that trigger alerts and subsequent response actions.