Which of the following is the PRIMARY objective of incident triage?

The primary objective of incident triage is to perform an initial assessment of potential security events to categorize and prioritize them. This process involves analyzing incoming data to determine if an event is a true security incident, its severity, and its potential impact on the organization. This categorization is the foundational step that dictates the urgency, the level of response required, and the allocation of resources for all subsequent incident handling phases, such as containment and eradication.

A. Coordination of communications: This is a critical function of the overall incident management process but is not the primary objective of the initial triage phase, which focuses on event analysis.

B. Mitigation of vulnerabilities: This is a corrective action performed during the post-incident or recovery phase to prevent future incidents, not during the initial assessment or triage.

D. Containment of threats: Containment is a distinct and subsequent phase in the incident response lifecycle that occurs only after triage has confirmed an event is an incident requiring action.

1. ISACA

CISM Review Manual

16th Edition. Domain 4: Incident Management

Section 4.3

"Incident Management and Response." The manual states

"The first step in responding to an incident is to determine its scope and impact... This process is often called triage." It further explains that incidents should be "classified based on their potential impact

" directly supporting categorization as the primary goal.

2. National Institute of Standards and Technology (NIST)

Special Publication (SP) 800-61 Rev. 2

"Computer Security Incident Handling Guide." Section 3.2

"Detection and Analysis

" describes the process that follows an initial detection (precursor or indicator). This phase involves analyzing the event to validate it

determine its scope

and prioritize it. This aligns directly with the concept of triage as a categorization and prioritization activity. Paragraph 1 of Section 3.2.2 states

"This information is used to prioritize the incident."

3. Peltier

T. R. (2013). Information Security Risk Analysis

Third Edition. CRC Press. Chapter 11

"Incident Response

" discusses the incident response process. The initial step after detection is consistently identified as analysis and classification (triage)

where the event is categorized to determine its severity and the appropriate level of response. This must occur before containment or eradication actions are planned. (ISBN: 978-1-4665-8669-5)