Assessment and decision on information security events
A.5.25
-
Last updated
Applicable
Catalog reference
Assess reported information security events and decide whether each one should be classified as an incident, with documented criteria for that decision.
Narrative — how we satisfy this requirement
Service desk engineers rate each incoming event with a severity table, and the written criteria for security events are still under review.