Incident Classification

Overview

Incident classification is the consistent assignment of an event to defined categories based on its cause, affected assets, impact, data exposure, threat type, service disruption, and reporting relevance.

Incident Classification is closely connected to Incident Severity, ICT-Related Incident, and Risk Taxonomy. Classification answers what kind of incident occurred, while severity expresses how serious or urgent the incident is; the two should be related but not treated as the same field.

Operational implementation should use a controlled taxonomy, define decision criteria, allow updates as evidence changes, map classes to owners and reporting duties, train responders, and record classification rationale.

The principal failure modes include inconsistent labels, premature conclusions, incompatible team taxonomies, missed regulatory triggers, and analytics distorted by repeated reclassification without history.

Useful measures include classification accuracy, reclassification rate, unclassified backlog, reporting-trigger misses, and consistency across teams.

Operationally, teams should use a controlled taxonomy, define decision criteria, allow updates as evidence changes, and map classes to owners and reporting duties. Key risks include inconsistent labels, premature conclusions, incompatible team taxonomies, and missed regulatory triggers.

A production treatment of Incident Classification should test the consistent assignment of an event to defined categories based on its cause, affected assets, impact, data exposure, threat type, service disruption, and reporting relevance within the relevant asset, decision, or service state. The Incident Classification context record for affected assets, impact, and data exposure should preserve source data, configuration or policy version, responsible actor, exception, and outcome. Review of Incident Classification should determine whether safeguards addressing affected assets, impact, and data exposure changed exposure in practice, not merely whether a document or setting existed.