Which of the following is the PRIMARY objective of incident triage?

The primary objective of incident triage is the rapid categorization, prioritization, and initial assessment of incoming security events. During the triage phase, security analysts evaluate alerts to determine their validity, scope, severity, and potential business impact. By accurately categorizing and prioritizing these events, the incident response team can efficiently allocate appropriate personnel and technical resources, determine the necessary urgency of the response, and assign the correct operational workflows. This ensures that critical, high-impact incidents are immediately addressed to minimize organizational damage, while lower-priority anomalies or false positives are filtered out, optimizing the overall efficiency of the incident management lifecycle.

A. This is a function of the broader incident management process and occurs after triage dictates the severity and identifies the required stakeholders.
B. Vulnerability mitigation is a proactive security measure or a post-incident remediation activity, not the immediate goal of the initial incident triage phase.
D. Containment is the subsequent phase of the incident response lifecycle, which is executed only after triage has successfully categorized and prioritized the incident.

1. ISACA CISM Review Manual, 16th Edition. Chapter 4: Information Security Incident Management, Section 4.5 (Incident Response Phases - Triage).

2. National Institute of Standards and Technology (NIST). (2012). Computer Security Incident Handling Guide (SP 800-61 Rev. 2). Section 3.2.4 (Incident Prioritization). https://doi.org/10.6028/NIST.SP.800-61r2