Has your organization established and documented incident criteria that are used to determine when an activity should be declared as a security incident?

This question assesses whether your organization has defined clear parameters for classifying security events as incidents requiring formal response. Effective incident criteria should include thresholds for impact, urgency, and scope that help security teams consistently determine when to escalate an event to incident status based on both known characteristics and reasonable assumptions about the activity. Evidence could include a documented incident classification matrix or decision tree that outlines specific criteria for incident declaration, severity levels, and examples of what constitutes different types of security incidents. This document should be part of your incident response plan and accessible to all security team members.