RS.MA-02 asks that incident reports are triaged and validated. In plain terms: when someone says something looks wrong, a named person checks it quickly, decides whether it is a security incident at all, and gives it a first severity estimate.
What good looks like
Every report lands in one place, whether it comes from a customer, an employee, an alert or a researcher. Someone owns the first look and does it within a stated time. The result is recorded: real incident, false alarm, or needs more information.
Severity comes from written criteria, not mood. Even three levels with a one line definition each is enough.
How to implement it
- Pick one intake path (a shared mailbox, a ticket queue, or a chat channel) and publish it to staff and in your security.txt or trust page.
- Assign a rotating triage owner with a backup.
- Write the first look checklist: is it security related, what is affected, is it ongoing, is customer or personal data involved.
- Define severity levels using impact and scope, for example data exposed, service down, single account only.
- Log the outcome for false alarms too. Patterns in false alarms often show a detection that needs tuning.
Evidence to collect
- The intake process description and where it is published.
- Severity criteria document.
- A sample of triaged tickets with timestamps, owner, verdict and severity.
- The triage rota.
Common gaps
- Reports arrive in three inboxes and nobody sees all of them.
- Triage happens in someone's head and leaves no record.
- Severity is set by whoever shouts loudest.
- No one is on point outside business hours.
Quick check
Does a false alarm need a record?
Yes. It shows reports are actually reviewed, and a run of similar false alarms points to a noisy detection worth fixing.
Sources
- NIST, The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29, February 2024: https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
- NIST CSF 2.0 implementation examples for RS.MA-02, as listed in the CSF 2.0 Reference Tool: https://www.nist.gov/cyberframework
CSF is voluntary guidance. There is no CSF certification, so use it to organize and show your own work.
