Engagement and Pursuit
Declaration, triage, reconstruction, evidence, escalation, eradication, communication
Adverse events shall be declared as incidents against defined criteria, and every declared incident shall be triaged, validated, categorized and prioritized within a stated period.
PurposeTo convert raw events into a decided position quickly, since this is the segment of the decision loop that most often binds.Activities11 · Metrics4For every declared incident, the organization shall reconstruct what took place — the entry, the movement, the dwell interval and the scope reached — and shall record the actions taken during the investigation.
PurposeTo establish what actually happened, since every consolidation activity depends on a reconstruction and none of them can be performed without one.Activities10 · Metrics4Incident data and metadata shall be preserved at a fidelity and for a period sufficient to support reconstruction, legal action and subsequent analysis, under a defined chain of custody.
PurposeTo ensure the material an engagement depends on still exists when it is needed, and is admissible where that matters.Activities10 · Metrics4Incidents shall be escalated against defined criteria to an authority that is reachable within a stated period, and the authority exercised shall be recorded against the action taken.
PurposeTo remove the search for a decision-maker from the decision loop, which is where the decide segment is usually spent.Activities10 · Metrics4Incidents shall be eradicated, the eradication verified, and the transition to recovery made against defined criteria with recovery actions selected, scoped and prioritized.
PurposeTo ensure the adversary is actually gone before the mission is restored, and that the transition is a decision rather than a drift.Activities11 · Metrics4Incident and recovery information shall be shared with designated internal stakeholders, external partners and the public as the situation and the agency's obligations require, within stated periods.
PurposeTo ensure the people who must know, do — inside the agency, across the federal community, and among those the mission serves.Activities11 · Metrics4