ASSURED Terms

ASSURED Methodology

A structured method for security event triage in seven phases: Alert, Subject, Scope, Uncover, Risk, Escalation decision, Documentation. It takes an analyst from “an alert fired” to “the case is closed or handed off, and the record survives.” It is not an incident-response framework: it ends where IR takes ownership.

Taught in: Introduction, What ASSURED is, and is not.

Phase

One of the seven steps, each with one question to answer and one deliverable to hand the next. The phases are a thinking order, not a waiting queue: a confirmed escalation criterion escalates from any of them.

Taught in: One-page reference.

Stage

A group of phases. There are three: Orient (Alert, Subject, Scope: what fired, who is involved, where the boundaries are), Investigate (Uncover, Risk: pull the evidence, rate it, recommend a move) and Resolve (Escalation decision, Documentation: decide, and leave a record someone else can reconstruct). Groups are always called stages, never phases.

Taught in: Introduction.

Investigation Loop

The deliberate cycle Scope → Uncover → Risk. Risk findings send the analyst back to Uncover for more evidence; a newly found entity re-enters Subject briefly, and Scope redraws the boundary. The loop runs until the residual risk is understood, or until a confirmed criterion hands the case to IR mid-loop.

Taught in: Risk, Introduction.

Case

The unit of work: the queue item, not the alert. Alerts that share an entity inside one time window, share a campaign indicator, or carry the same vendor incident ID form one case. The riskiest member sets the case’s depth level. The activity verdict, the priority and the Escalation decision are recorded once per case; each member alert keeps its own detection-axis verdict so detection engineering gets per-rule feedback.

Taught in: Correlated cases. Recorded in: event report decision header (Status, with related case IDs).

Escalation Decision

The sixth phase (E), and the one that decides. Its question: close or escalate, and who needs to know? Risk recommends; the Escalation decision makes and records the call by the E rule. A documented close is one of its two outcomes, not the absence of one. Early exits (a Level 0 close, or an escalation tripwire fired in an earlier phase) are early Escalation decisions, recorded in the same fields.

Taught in: Escalation decision. Recorded in: event report decision header (Escalation decision, who decided, and when).

Four Dimensions

Subject’s assessment frame, run on every entity that authenticated or acted: authentication, authorization, behavior and relationships. A new entity found later in the loop gets the same four questions.

Taught in: Four dimensions. Recorded in: handoff packet section 3, Entities.

Four Boundary Types

Scope’s frame for where the investigation’s lines are: regulatory (which notification clocks and preservation duties attach), time (the window to examine), entity (which subjects are in) and infrastructure (what the SOC can actually see). Scope is provisional: Risk can push it wider.

Taught in: Scope. Recorded in: event report section 3, Origin and scope.

Second Subject

A second independent actor, or any additional account or host the activity moved into. A single subject is one primary entity plus the sessions, devices and processes it directly used. A second subject moves a case to Level 2; confirmed, it is also the lateral-movement criterion.

Taught in: The fast path (Level 1).

Desk Card

The whole method on one printable page: what each phase asks and produces, the matrix and clocks, the escalation checklist, the confidence rubric, the depth ladder and the closure review. It reminds; the chapters teach.

Taught in: One-page reference.

Depth Ladder

The per-case decision of how much of the seven-phase arc a case gets: Level 0, Level 1 or Level 2. It is made at intake and revised only upward. Depth and urgency are separate decisions: the ladder sets how much process a case gets, while the escalation tripwire and the triage matrix set how fast it moves.

Taught in: The fast path. Recorded in: “Depth level worked (0 / 1 / 2)” on the event report, “Depth level at handoff” on the handoff packet.

Level 0 (Pattern Close)

The five-minute rung, for a case that matches a current entry in the pattern library. The subject passes the eligibility gate, every discriminator checks out against its source system, and nothing about the case is novel. Only the authorized and benign-confirmed activity verdicts close here. The close is an early Escalation decision, recorded in the five-field record.

Taught in: The fast path, the Level 0 drill. Recorded in: pattern-close-record.md.

Level 1 (Standard Triage)

The compressed pass, about 15 to 45 minutes, for a case with no matching pattern (or one failed discriminator) and a bounded blast radius: a single subject, ordinary privilege, and nothing suggesting the activity touched regulated data. Every phase runs; several collapse into single moves, and Uncover narrows to the one question the verdict turns on.

Taught in: The fast path. Recorded in: alert-report.md.

Level 2 (Full Arc)

The seven phases as the chapters teach them, about 25 to 80 minutes for a senior analyst. Any one trigger suffices: a crown-jewel subject, a privileged identity, or regulated data plausibly accessed by the activity under review; a second subject; a novel detection or a correlated chain; a spike in closes against one pattern entry; anything suspicious Level 1 could not resolve. Regulated data merely in reach is a Scope flag, not a Level 2 trigger.

Taught in: The fast path and every chapter. Recorded in: event-report.md.

Ratchet

The ladder’s one-way rule: any surprise moves a case up a level, and it never slides back down mid-case. Down-scoping happens only between cases.

Taught in: Ladder rules. Recorded in: the depth-level field, with each upward move and its reason.

Eligibility Gate

The three checks a subject must pass before any Level 0 close, each proven from its source system: (a) not a crown-jewel asset; (b) not a privileged identity, and not automation with deploy, signing, secrets or repository-write capability; (c) no regulated data in reach (standing access to a store the data inventory classifies as regulated). Unknown fails the gate. A grouped case passes only if every member passes.

Taught in: The fast path. Recorded in: pattern-close record section 3, Checks (Eligibility gate).

Privileged Identity

For the gate and the ladder: a member of a privileged role or group in the identity provider, or automation holding deploy, signing, secrets or repository-write rights (a CI runner can outrank its owner). A privileged identity always fails the gate and routes to Level 2, however routine its work.

Taught in: Ladder rules.

Expected-Change Record

The privileged counterpart of a pattern entry: a documented record, linked to its change ticket, listing the checks a recurring privileged change needs. It speeds the Level 2 pass; it never closes the case at Level 0.

Taught in: Exercise 2.

Pattern Library

The SOC’s written catalog of known-benign patterns, governed like code: second-person approval, version history, invalidation triggers, an optional machine-close flag, and a reversal threshold that suspends an entry automatically. Level 0 runs on it, not on memory: “I’ve seen this before” is not a pattern.

Taught in: Ladder rules.

Pattern Entry

One record in the pattern library: the benign behavior, its named discriminators, known mimicry and blind spots, eligibility constraints, an owner, an approver, a review date (every 90 days by default), the governance fields, a validation test that generates an imitation the discriminators must still catch, and the close history. Every Level 0 close cites the entry and the version it matched. A case contained by a control is a pattern-entry candidate.

Taught in: Ladder rules. Recorded in: pattern-entry.md; cited in pattern-close record section 2, Pattern.

Discriminator

A named, checkable fact that separates a documented benign pattern from its malicious lookalike. A Level 0 close requires every discriminator to check out against its source system; one failure makes it a Level 1 case. Prefer fields an attacker cannot cheaply forge: exact destination, parent process, extension or plugin ID, directory group membership. Signer, install path, names and ports are table stakes, never discriminators on their own, because a signed host runs third-party code (extensions, MCP servers, package-manager scripts).

Taught in: Ladder rules. Recorded in: pattern-entry Discriminators; pattern-close record section 3 (with what was actually observed).

Invalidation Trigger

An event that forces immediate re-review of a pattern entry, with its closes moving to Level 1 meanwhile: the linked rule changed, the asset group was re-tagged, abuse of the pattern was observed, or, for an AI-matched entry, the model, prompt or tool version changed.

Taught in: Ladder rules. Recorded in: pattern-entry Governance.

Reversal Threshold

The number of confirmed false closes that suspends a pattern entry automatically until its owner re-reviews it. By default, one.

Taught in: Ladder rules. Recorded in: pattern-entry Governance.

Level 0 Audit Sample

The weekly re-check of Level 0 closes: a second analyst re-verifies a random sample against raw telemetry, starting at 2 to 5 percent per pattern and at least one close per pattern. A confirmed false close suspends the pattern. A pattern that is never sampled is not a pattern.

Taught in: Ladder rules. Recorded in: pattern-entry History (audit-sample results).

Five-Field Record

Level 0’s entire documentation: Alert, Pattern, Checks, Verdict, Closure. Anything that cannot be honestly captured in these five fields does not belong at Level 0.

Taught in: The five-field record. Recorded in: pattern-close-record.md.

Hypothesis Ledger

The working table kept next to the timeline. Each hypothesis gets a line: what you think happened, the evidence for it, the evidence against it, and its status (open, supported, refuted). Open it with at least two lines, one of them the most plausible benign explanation: a ledger with one line is a conclusion, not a test. Every query should name the line it tests. It is Analysis of Competing Hypotheses at triage speed.

Taught in: Pivot discipline. Recorded in: the Hypothesis ledger block on the alert report, event report (section 3) and handoff packet (section 4, with the rejected hypotheses).

Confidence Rubric

The single High / Medium / Low scale for analytic confidence, used for Subject’s per-entity verdicts, Uncover’s evidence chain, the line Risk records beside the matrix cell, the handoff packet and the escalation tripwire. High: direct evidence from a source trusted for this kind of claim, independently corroborated, alternatives tested and ruled out. Medium: single-source evidence or strong inference, nothing contradicting it. Low: circumstantial, incomplete, or resting on the absence of contrary evidence. Label the claim, not the case; between two levels, round down.

Taught in: Documentation standards. Recorded in: handoff packet timeline rows and section 5 (Confidence in that judgment); event report decision header.

Confirmed

Supported at High on the confidence rubric. A single threat-intelligence match, an ATT&CK mapping or asset value alone never confirms anything. A confirmed escalation criterion fires the escalation tripwire.

Taught in: Escalation criteria.

Suspicion

A criterion supported below High confidence. Suspicion refines Scope and re-runs the loop; it does not fire the escalation tripwire. It still counts in the matrix: a probable-but-unconfirmed case can sit at P1 or P2 and escalate by the E rule.

Taught in: Escalation criteria.

Unknown Is Not Low

The evidence rule. When the evidence that would decide a question could not be examined (telemetry missing, a source unqueried, a join failed), likelihood reads Medium at minimum, confidence reads Low, and the gap is recorded as an open question. “We could not check” never reads the matrix from the same cell as “we checked and it is clean.” At the eligibility gate the same rule reads: unknown fails.

Taught in: The priority matrix, When the verdict stays undetermined.

Open Question

A named gap: what could not be resolved, what evidence would answer it, and the trigger that will re-score the case. Open questions travel with the case so the next owner starts from them; “none” must be earned.

Taught in: The handoff packet. Recorded in: handoff packet section 8; “Open uncertainty” on the event report.

Confirmed Reach

The impact rule for footprint: asset criticality scores the highest-value asset the activity has confirmed reach to, not just the entry point, so spread toward a more valuable asset raises impact.

Taught in: The priority matrix.

Risk-Based Alert Triage Matrix (RATM)

ASSURED’s own risk-scoring model, not an industry standard. Four dimensions (asset criticality, threat actor intent, exploitation & scope, business impact) are each scored High, Medium or Low, then reduced to the two axes of the triage matrix. Impact is the higher of asset criticality and business impact. Intent and exploitation & scope inform likelihood, which never rises above what the evidence supports. Adapt the rubric anchors to your environment; keep the reduction rules. Unrelated to Splunk’s Risk-Based Alerting despite the similar name.

Taught in: The priority matrix. Recorded in: handoff packet section 5 (the four RATM lines).

Triage Matrix

The three-by-three grid of impact by likelihood. Each cell gives a priority band and a recommended move. Confidence is recorded beside the cell and does not move it. The cell is the default; three override rules can change it, and the record names the rule that fired.

Taught in: The triage matrix in practice. Recorded in: handoff packet section 5 (Matrix cell and priority).

Impact

The first axis of the matrix: if this activity is real, how bad would it be? Scored as the higher of asset criticality and business impact, against the most valuable asset in confirmed reach. It answers “how bad if real,” not “how bad so far.”

Taught in: Impact and likelihood.

Likelihood

The second axis of the matrix: how probable it is, given the evidence, that the activity is malicious or unauthorized (High, Medium or Low). It is an estimative judgment, not a grade of evidence quality; analytic confidence in it is a separate line on the confidence rubric. Calibration factors can move it by at most one step, with the reason written down.

Taught in: Impact and likelihood. Recorded in: handoff packet section 5 (Likelihood that the activity is malicious or unauthorized).

Priority Band (P1 to P4)

How fast someone must act, read off the matrix cell. A priority scale, not a severity taxonomy: vendor severity is the detection’s opening guess, while the band is the analyst’s call after scoring. Any confirmed criterion makes the case P1 whatever the cell. The default clocks are in the table below.

Taught in: Default clocks, Priority levels. Recorded in: “Priority at close” on the event report.

Re-score Trigger

The named event and time at which a P3 or undetermined case is scored again: a log delivery, the end of a forward watch, an owner’s answer, or a fixed time when nothing better exists. P3 work runs to the trigger, then the case closes or escalates. A P3 without a named trigger is a parked case.

Taught in: When the verdict stays undetermined, The E rule. Recorded in: “Recommended move” on the alert report and handoff packet.

High-Impact Clock

The second override rule. A High-impact case whose likelihood is genuinely Low (the evidence was examined and leans benign) stays at P3 but re-scores within hours, 4 by default, with named upgrade triggers and the queue lead or asset owner aware it exists. If likelihood is “Low” only because the evidence is missing, that is unknown, not Low: the case reads High/Medium, P2.

Taught in: The override rules.

Override Rules

The only three ways a matrix cell is modified, applied in order: (1) the escalation tripwire raises the case to P1; (2) the high-impact clock tightens a High/Low P3; (3) de-escalation is explicit, with a named reason and the same notification an upgrade would get.

Taught in: The override rules. Recorded in: “Override applied” in handoff packet section 5.

Contained by Control

Malicious activity that a control blocked or quarantined, with no execution or follow-on evidence. Verify that the control held (the block or quarantine event, no process from the artifact, no callback), record the case at P3 or P4, and propose it as a pattern-entry candidate. It does not page IR. This is why criterion 1 reads “confirmed malicious activity not fully contained by a control.”

Taught in: The override rules, Escalation criteria.

Recommended Move

Risk’s output alongside the cell: escalate, keep working to a named re-score trigger, or close. Risk recommends; the Escalation decision decides.

Taught in: The triage matrix in practice. Recorded in: “Recommended move” on the alert report and handoff packet.

E Rule

The Escalation decision’s one rule, the same wherever the method states it:

Escalate if a criterion is confirmed or the matrix places the case at P1 or P2. At P3, keep working to the named re-score trigger, then close or escalate. Close at P4. Record the cell either way.

A documented close is a first-class verdict, held to the same evidence standard as an escalation.

Early exits are early Escalation decisions: a Level 0 close, or an escalation tripwire fired in Alert, Subject, Scope, or Uncover, is recorded in the same decision fields with its time.

Taught in: The E rule. Recorded in: the Decision block of escalation-checklist.md.

Escalation Criteria

The four canonical categories, checked at every phase: confirmed malicious activity not fully contained by a control; high impact on business-critical systems; lateral movement or exfiltration; an ongoing or widespread campaign. Each is a criterion only when confirmed.

Taught in: Escalation criteria. Recorded in: escalation-checklist.md; “Why escalated” in the handoff packet.

Escalation Tripwire

The rule that a confirmed escalation criterion escalates immediately, from any phase, and makes the case P1 whatever its matrix cell, even from inside a five-minute Level 0 check. Page the IR lead, preserve what containment would destroy, start the warm handoff, and let the remaining phases finish under IR’s clock. Always written with “escalation”, because Tripwire is also a file-integrity product. Formerly called the break-glass rule.

Taught in: Escalation criteria, Ladder rules. Recorded in: “Override applied” (escalation tripwire) and “Why escalated” in the handoff packet.

Break-glass rule (former name)

The former name of the escalation tripwire. Renamed so that “break-glass” keeps only its industry meaning: the emergency-access accounts used when the normal admin path is broken. See Escalation Tripwire above.

Taught in: Escalation criteria.

Late P1

A P1 declared well after its first criterion was confirmed. The clock that matters runs from the first confirmed criterion to the page, not from the alert to a finished packet, and later confirmations do not restart it.

Taught in: Escalation criteria. Recorded in: “Key times” on the event report; tracked as the criterion-to-page interval in Measuring triage.

Routes to Escalation

Three, and the handoff names the one that fired: a confirmed criterion (the escalation tripwire, P1); the matrix (a P1 or P2 cell with no criterion confirmed); or an operational route such as capacity, when a single analyst cannot both watch the queue and work the case.

Taught in: Escalation criteria. Recorded in: “Why escalated” in the handoff packet.

Tier Up / Engage IR

Two different moves. Tiering up hands a case to the next tier inside the SOC; engaging IR brings in incident response, on the escalation tripwire or a P1 or P2 cell. The tripwire engages IR directly and bypasses the tiers.

Taught in: Escalation protocols.

Documented Close

A first-class verdict, not the absence of an escalation, held to the same evidence standard. It passes the closure check, names its open uncertainty, and, for benign and authorized closes, writes the reopen conditions. Most triaged cases end here.

Taught in: Closing at triage. Recorded in: the event report decision header (Escalation decision, Open uncertainty, Reopen conditions).

Closure Check

The five conditions a documented close must meet: no criterion confirmed or open as a suspicion; the cell allows it (P4, or a P3 whose re-score trigger came back clean); no persistence or credential access in the evidence examined; the case’s own alternatives checked clean; every gap named, with reopen triggers.

Taught in: Closing at triage. Recorded in: the Closure check block of escalation-checklist.md.

Warm Handoff

A live, synchronous handoff on a call or bridge in which the receiver confirms ownership, as opposed to a ticket reassignment. Required at P1, where the packet completes in parallel.

Taught in: Escalation criteria, Paging and acknowledgment. Recorded in: “Warm handoff held” in the handoff packet’s P1 page block.

Handoff Packet

The escalation record: a case-metadata header, then nine sections (case summary, timeline, entities, evidence chain, risk verdict, containment actions taken, artifacts, open questions, communication record). It lets the receiver act without a call back to the analyst, and it is also the documentation record an auditor reads months later.

Taught in: The handoff packet. Recorded in: handoff-packet.md.

Receipt

The three lines the receiver fills in: accepted by and at, escalation warranted (yes, no or partially, with why), and rework requested. Until it is filled in, triage still owns the case and the acknowledgment fallback keeps running.

Taught in: Handoff acceptance. Recorded in: the Receipt block of the handoff packet.

Pre-authorized Actions

A short, written list of immediate containment actions triage may take without waiting for IR (typically isolate a host, disable an account, revoke sessions, disable a consented application’s sign-in), agreed in advance with IR and the business owners. Reversible only. Non-reversible actions, such as a credential reset or an OAuth grant revocation, need IR or owner approval unless the protocol lists them explicitly as pre-authorized for that scenario. Verify that each action took effect.

Taught in: Containment authority. Recorded in: handoff packet section 6, Containment actions taken.

Preserve Before You Contain

The ordering rule for containment: capture the volatile evidence and the artifacts a containment action would destroy or age out (memory, sign-in and session records, the definition of a rule before it is disabled), then take the pre-authorized action.

Taught in: Preserve before you contain, Containment authority. Recorded in: “Preserved first” in handoff packet section 6.

De-escalation

The explicit path back down. A priority moves down only with a named reason in the case and the same stakeholder notification an upgrade would get. A confirmed criterion is not the triage analyst’s to downgrade: only the receiving owner can, after receipt.

Taught in: Escalation protocols, The override rules.

Insider-Risk Route

The path for cases whose subject is an employee or contractor: the IR lead, the insider-program lead (or HR) and legal on one bridge, case visibility restricted, the subject’s manager and team not notified. Analysts record observable technical activity. HR-held context reaches the case only through this route, and never as analyst-collected notes.

Taught in: Escalation protocols, Insider analysis. Recorded in: “Insider route” in the handoff packet’s case metadata.

Credential-Exposed

The status of any user who reached the credential step of a phishing kit. They stay credential-exposed until the password is reset, sessions are revoked and MFA methods are reviewed, and they are treated as a primary entity whatever the alert named.

Taught in: Entity scope, The priority matrix.

Level 0 Parity

The boundary for machine execution: a machine may close a case only where a human could close it at Level 0, under the same governed pattern entry, and only when all of these hold. The entry carries the machine-close flag; every discriminator is evaluated by code against an authoritative source; the eligibility gate is enforced by code; humans QA-sample the machine’s closes; reversal and miss rates are tracked; a kill switch and a named owner exist. Everything above Level 0 parity stays with the analyst, and AI assistants remain advisory there.

Taught in: Governed automation, Ladder rules. Recorded in: pattern-close record section 5 (the automation and pattern version).

Machine-Close Flag

A per-entry, per-version switch on a pattern entry, off by default, that permits a machine close once every Level 0 parity condition holds. Turning it on needs the approver’s sign-off.

Taught in: Governed automation. Recorded in: pattern-entry Governance (Machine-close flag, Kill-switch owner).

Admission Gate

The seven organizational checks an AI assistant must pass before any case data reaches it: an approved provider; data boundaries by classification; minimization and redaction; retention, training and residency terms; least privilege with no outbound channel (no web fetches, no rendered remote links or images, every tool and MCP server inventoried, retrieval that respects the user’s permissions); logging and DLP; and a recorded human authorization. If any check is unapproved or unknown, the work follows the non-AI path.

Taught in: AI-assisted triage.

Material AI Use

The record line that says which assistant and version were used and which sections began as AI drafts, or “none.” It lets a later reader weight the provenance of what they are reading.

Taught in: AI-assisted triage. Recorded in: every template (pattern-close record section 5, alert report, event report, handoff packet).

Two-Axis Verdict

Every verdict answers two separate questions. The detection axis asks whether the rule was right: true positive, false positive (logic), or false positive (data). The activity axis asks what the activity was: malicious, policy violation, authorized (benign true positive), benign-confirmed, or undetermined. Write the values exactly as given.

Taught in: What validation decides, Documentation standards. Recorded in: the verdict fields of every template.

True Positive

Detection axis: the alert fired on exactly the behavior its logic describes. On its own it does not say whether that behavior was malicious or authorized; the activity axis does.

Taught in: Validation. Analyst usage and platform labels: C.L.E.A.R..

False Positive

Detection axis: the logic matched something it should not have, because the behavior the rule claims did not occur. There are two kinds. False positive (logic): a logic flaw or an over-broad pattern. False positive (data): a parsing error, a missing field or bad telemetry. The fix is on the detection side.

Taught in: What a benign close teaches. Analyst usage and platform labels: C.L.E.A.R..

False-Positive-as-Finding

Every false positive is a defect report against the detection, not just a closed ticket. The close records which kind it was, false positive (logic) or false positive (data), and routes a tuning request to detection engineering. A benign true positive is not a false positive and does not tune the rule; its close feeds context instead. A false positive answers only the detection axis: the activity the alert fired on still needs its own verdict.

Taught in: What a benign close teaches, The tuning request. Recorded in: tuning-request.md; “Next action” on the alert report.

Policy Violation

Activity axis: the activity broke policy without evidence of malicious intent. It cannot close at Level 0; the case moves to Level 1.

Taught in: What validation decides.

Benign True Positive

The detection fired correctly on activity that turns out to be authorized: a red-team exercise, an admin’s sanctioned use of a dual-use tool, a scanner doing its job. Recorded as true positive on the detection axis and authorized on the activity axis. Never call it a false positive. Its close feeds context rather than tuning: a pattern-entry proposal, or a scoped exception keyed to the tool version, extension or plugin ID and destination set, with an expiry, an owner and re-fire triggers, never to signer and install path alone.

Taught in: Deconflict authorized activity, What a benign close teaches.

Benign-Confirmed

Activity axis: nothing harmful or policy-relevant happened, and the evidence shows it. With authorized, the only activity verdict that can close at Level 0.

Taught in: What validation decides.

Undetermined

Activity axis: the deciding evidence is missing. A legitimate verdict, but not a benign close and not a place to park a case. Score the gap (Medium likelihood at minimum, Low confidence), name the re-score trigger, and at the trigger apply the E rule: escalate at P1 or P2; at P3 or P4 close only with the gaps named and a reopen trigger written, or move the case up a level.

Taught in: When the verdict stays undetermined.

Merged into Case

A status on a member alert that was grouped into a case, not a disposition. The member keeps its own detection-axis verdict; the case carries the activity verdict.

Taught in: Correlated cases. Recorded in: “Status” on the event report.

Platform close codes map onto the two axes without replacing them. Record the ASSURED pair in the case; derive the console label from it.

Source: Microsoft Learn, Sentinel basic incident tasks (updated August 2026) Source: Microsoft Learn, Manage incidents in the Defender portal (legacy experience, updated September 2026)

Source: Microsoft Learn, Manage emergency access admin accounts (updated June 2026) Source: NIST SP 800-61r3 (April 2025) Source: NIST CSRC glossary, incident