RS.MA-03 says incidents are categorized and prioritized. After triage confirms something is real, you decide what kind of incident it is, how it ranks against everything else in flight, and what response strategy fits.
What good looks like
You use a short list of incident types, such as data breach, ransomware, account compromise, denial of service, malicious insider and lost device. Each type points to a playbook. Priority comes from three questions: how far has it spread, what is the likely impact, and how time critical is it. The incident lead also chooses a strategy on purpose: contain and recover fast, or hold back briefly to watch the attacker and learn more.
How to implement it
- Define five to eight categories in your incident plan and link each to a playbook or checklist.
- Score priority with a simple grid. For example, P1 for confirmed data loss or a down production service, P2 for contained compromise of one system, P3 for suspicious but unconfirmed activity.
- Re-rank when facts change. An incident can move up as scope grows.
- Record the chosen strategy and the reason in the ticket.
- Review category counts quarterly to see where your exposure is.
Evidence to collect
- Category list and priority grid.
- Tickets showing category, priority, strategy and any re-ranking.
- A quarterly summary of incidents by category.
Common gaps
- Everything is marked urgent, so nothing is.
- Categories exist but no playbooks match them.
- Strategy is never stated, so responders disagree mid incident.
- Priority is set once and never revisited.
A worked example
A finance employee reports a strange sign in alert at 9:10. Triage confirms it is real. The responder categorizes it as account compromise, not data breach, because nothing suggests data left yet. Scope is one mailbox, impact could grow because the account approves payments, and it is time critical, so it is P2 with a rule to upgrade to P1 if any payment instruction was altered.
The lead then picks a strategy. Containing now means disabling the account and revoking sessions, which ends the attacker's access immediately but gives up the chance to see what they do next. Because the account touches payments, the lead chooses to contain now and rely on the mailbox audit log for the investigation. That reasoning goes in the ticket in two lines.
At 10:30 the audit log shows a forwarding rule to an external address created two days ago. Scope has changed. The lead raises the priority to P1, adds the communications owner, and extends the review to every message forwarded in that window.
None of this needs special software. It needs a category list, a grid and the habit of writing the decision down.
How to start this week
- Take your last five security tickets and label each with a category and a priority using your draft grid. If you cannot agree on a label, the definition needs work.
- List the playbooks you would want for your top three categories and write the shortest useful version of each.
- Add two fields to your ticket template: category and strategy.
- Put a recurring reminder to re rank open incidents every few hours while they run.
Questions auditors and customers ask
- How do you decide which incident gets attention first? Show the grid and a ticket where priority changed.
- Who decides between fast recovery and further investigation? Show the strategy field and the named role.
- How do you learn from the pattern of incidents? Show the quarterly counts and one change that came from them.
Quick check
Why record the strategy choice?
Because containing fast and watching the attacker pull in opposite directions. Writing the decision down keeps the team aligned and shows later that it was deliberate.
How many categories is too many?
If responders cannot remember them without looking, you have too many. Start small and split a category only when it needs a different playbook.
Sources
- NIST, The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29, February 2024: https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
- NIST CSF 2.0 implementation examples for RS.MA-03, as listed in the CSF 2.0 Reference Tool: https://www.nist.gov/cyberframework
CSF is voluntary guidance. There is no CSF certification, so use it to organize and show your own work.
