Event-to-incident categorisation and assessment
Primary statement
Event assessment: ISO A.5.25 assess events and decide if categorised as incidents. ISO A.8.15 logs analysed. NIST CSF event analysis + supply chain risk integration. NIS2 incident reporting. NIST 800-53 IR-4 incident handling. The event-to-incident categorisation is the upstream of incident response.
Audit-fatigue payoff
A single event assessment procedure + categorisation criteria + automated triage + escalation matrix satisfies event-to-incident requirements across all 6 contributing frameworks.
Strictness matrix
Scope
Scope: ALL information security events assessed for categorisation as incidents. No event category exempt from assessment.
Ceiling source: iso27001:A.5.25
Rationale: ISO 27001 A.5.25 universal-event scope is the foundational specification.
Threshold
Threshold: documented criteria for event-to-incident categorisation. Criteria-driven (not analyst discretion) for consistent triage.
Ceiling source: iso27001:A.5.25
Rationale: ISO 27001 A.5.25 criteria-driven threshold is the audit-defensible operational test.
Method
Method: documented assessment criteria + automated triage where feasible + analyst review for ambiguous events + escalation to IR pipeline on categorisation as incident + log analysis (A.8.15) supporting assessment.
Ceiling source: iso27001:A.5.25
Rationale: ISO 27001 A.5.25 + A.8.15 combined are the most prescriptive method.
Frequency
Event assessment: continuous (per event). Criteria review: annual + on threat landscape change.
Ceiling source: iso27001:A.5.25
Rationale: Continuous per-event assessment is the floor.
Evidence
Evidence: assessment criteria + event log + sample assessments traced through to incident categorisation or closure as non-incident + escalation records.
Ceiling source: iso27001:A.5.25
Rationale: ISO 27001 A.5.25 evidence with sample traces is comprehensive.
Auditor test pattern
Step 1: Inspect event assessment criteria. Step 2: Sample 3 events from the past month; verify assessment outcome. Step 3: For one event categorised as incident, trace escalation to IR pipeline. Step 4: For one closed-as-non-incident, verify documented reasoning.
Common findings
Common findings: (1) Criteria absent — analyst discretion; (2) Events closed without documented assessment; (3) Categorisation criteria stale; (4) Escalation to IR pipeline informal.