Has your organization established and documented incident criteria that are used to determine when an activity should be declared as a security incident?

Knowing when an event becomes an incident is the focus: assessors want documented incident criteria that determine when activity should be formally declared a security incident. Effective incident criteria should include thresholds for impact, urgency, and scope that help security teams consistently determine when to escalate an event to incident status based on both known characteristics and reasonable assumptions about the activity.

Evidence could include a documented incident classification matrix or decision tree that outlines specific criteria for incident declaration, severity levels, and examples of what constitutes different types of security incidents. This document should be part of your incident response plan and accessible to all security team members.