Security incidents
First actions and responsibilities.

Users should report suspicious messages without opening links or attachments or replying. Sender checks should use independently obtained contact details. CISA also recommends deleting the message after reporting it, but does not explain whether that reporting method preserves the original and investigation data. Its phishing guidance does not prescribe disconnection for every suspicious email. [01]

A report should include the time, description, available evidence and contact details. ENISA describes accessible reporting channels and lists knowledge of the reporting mechanism and contact point as an example of evidence. For initial BCM reports, BSI adds location, reporter, affected people or processes, possible causes, measures already taken and observed effects, distinguishing facts from assumptions. [02] [03]

BSI DER.2.1 A15 provides for service-desk training to recognise security incidents. This recognition task does not confer general classification or case-closure authority. Incident classification and the operational emergency decision concern different aspects of the situation. [08] [03]

For serious malware incidents, BSI advises isolating affected systems without initially shutting them down or powering them off. It warns against privileged login while a potentially infected system remains connected to the production network or internet. For ransomware, CISA calls for immediate, coordinated isolation to limit spread. [04] [05]

Selection of containment measures considers further damage, operational and availability impacts, duration, resources, effectiveness and evidence preservation. Limiting damage and preserving evidence can conflict. The technical passages do not assign isolation to a general user or support role or instruct users to create forensic images. [06] [04] [05]

An event is an observable occurrence in an IT environment. NIST defines a security incident as actual or imminent unauthorised harm to confidentiality, integrity or availability, or a violation or imminent threat of violation of relevant rules. A malware finding is not required. Classification uses analysis, defined incident criteria and organisation-specific thresholds, including validation and prioritisation. [07] [08]

Incident handlers verify, analyse, prioritise and respond. They may work internally, externally or in a combined function, with system and network administrators also participating. Some analyses require specialised technical experience. NIST recommends defining disconnection and shutdown authority in the response policy. Leadership may decide measures with major operational effects. [07]

BSI DER.2.1 A3/A11 address classification responsibilities and procedures. A5 requires IT operations leadership to approve selected remediation measures. BSI 200-4 also requires clarity about who may or must perform immediate measures. Strategic security decisions must involve the information security officer under DER.2.1 chapter 3. [08] [03]

John P. Pironti recommends agreeing when responders may act and then notify others, and when they must obtain a decision first. This is advice in an ISACA author contribution, not a COBIT requirement. [09]

Under BSI 200-4, an operational emergency affects time-critical business processes that normal operations cannot restore within the maximum tolerable downtime. A dedicated response organisation (BAO) is required. Preventive activation is possible when disruption is imminent, including without a cyberattack. A crisis has serious effects and overwhelms normal operations. Emergency plans are absent or insufficient. There is no mandatory progression from event to incident, emergency and crisis. [03] [07]

Competence includes education, training and experience. ENISA assigns event assessment to the organisation without prescribing one job title, and lists competence records as evidence examples. Its §3.1.2(c) reproduces the competent-personnel requirement for covered entities. BSI 200-4 §4.3 requires qualification evidence for BCM roles. Neither establishes one mandatory personal certificate for all incident handlers. [02] [03]

CIS Control 17 covers a responsible person and backup, the reporting process, roles and communication. Its event and incident thresholds in safeguard 17.9 apply to Implementation Group 3 (IG3). BSI DER.2.1 A16 recommends documenting the case before closure and agreeing quality-assurance requirements with the information security officer in advance. It does not give the initial report recipient authority to close the case. [11] [08]

CISA’s user-facing phishing advice, ransomware guidance and 2021 US Federal Civilian Executive Branch playbooks have different scopes. Federal reporting and authority rules are not universal company duties. BSI’s first-aid guide concerns serious incidents. ENISA’s 2025 document distinguishes regulatory requirements for covered entities, implementation guidance and evidence examples. This overview does not determine any organisation’s legal obligations. [01] [05] [06] [04] [02]