This lesson develops practical capability in Detection, Reporting, Triage, Classification, Analysis, and Evidence within ISO/IEC 27035 Foundation (PECB). Activities reflect a security team coordinating users, technical responders, business owners, legal counsel, communications, and external providers, keeping responsibilities, decisions, evidence, exceptions, and improvement actions connected.
The work contributes to the wider course objective to interpret ISO/IEC 27035 incident management principles, preparation, detection, triage, response, recovery, learning, and improvement.
The instructor traces a realistic case involving a security team coordinating users, technical responders, business owners, legal counsel, communications, and external providers. The demonstration shows how to define scope and criteria, collect evidence, record decisions in incident triage and evidence record, and challenge the condition where detection is undocumented or assigned to conflicting owners.
Complete a controlled exercise for Detection, Reporting, Triage, Classification, Analysis, and Evidence. Establish responsibilities and acceptance criteria, examine the case where detection is undocumented or assigned to conflicting owners, reach a supported conclusion, and preserve the result in incident triage and evidence record.
Begin with the earliest point where expected practice and observed evidence diverge. Separate a missing record from an ineffective process, and distinguish role ambiguity from a control or competence failure. Treat “detection is undocumented or assigned to conflicting owners” as a hypothesis until the response is tested against the applicable criteria and intended outcome.
Learners can apply Detection, Reporting, Triage, Classification, Analysis, and Evidence, explain the reasoning used, and defend the result through incident triage and evidence record.