← CIS Controls v8 in plain English

17.9 IG3

Control 17 / Incident Response Management

Establish and Maintain Security Incident Thresholds

Think of it likeSetting criteria for when to call the police versus when to handle a situation yourself.

In plain English

Clear thresholds decide when a security issue is serious enough to escalate, versus when it can be handled in-house.

Related CSF subcategories (unofficial mapping)

DE.AE-08: Incidents are declared when adverse events meet the defined incident criteria.ID.IM-04: Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved.RS.MA-02: Incident reports are triaged and validated.RS.MA-03: Incidents are categorized and prioritized.