CRIE key terms

A structured sequence of phases an organization follows to handle a security incident, typically covering preparation, detection and identification, containment, eradication, recovery, and post-incident review. It gives teams a repeatable path from discovery to full restoration.

A documented set of roles, procedures, and decision points that guides an organization's response to a security incident. It defines who does what, how incidents are escalated, and what thresholds trigger each level of action.

A high-level management statement that establishes an organization's commitment to incident response, assigns authority, and sets mandatory requirements. It sits above procedures and playbooks, which describe how the policy is carried out day to day.

A step-by-step operational guide for handling a specific incident type, such as ransomware or business email compromise. It lists concrete actions, decision branches, and required evidence so responders can act consistently under pressure.

A detailed technical procedure for executing a narrow task, such as isolating a host or resetting a service account during response. Runbooks complement playbooks by supplying the exact commands and checks for individual actions.

The defined route and criteria for moving an incident from one responder or tier to another, including who must be notified and when. Clear escalation paths reduce delay when an incident exceeds the authority or skill of the initial handler.

A discussion-based simulation in which participants walk through a fictional incident scenario to test plans, roles, and decisions without touching live systems. It surfaces gaps in communication and procedure before a real event occurs.

The phase in which monitoring tools and human analysis reveal that a security event is occurring and confirm whether it qualifies as an incident. It produces the initial scope, severity, and classification used to drive the response.

A observable artifact such as a malicious file hash, IP address, domain, or registry key that suggests a system has been breached. Indicators support detection and scoping but can become stale or be deliberately changed by attackers.

A behavioral or contextual signal that focuses on attacker intent and technique rather than static artifacts, such as unusual lateral movement or credential dumping. These indicators tend to remain useful longer than file-based compromise indicators.

The rapid assessment of an alert or report to decide its severity, validity, and priority relative to other work. Effective triage separates genuine incidents from noise and routes each case to the right responders.

An alert that appears to indicate malicious activity but is actually benign behavior, such as a legitimate administrative script. Tracking false-positive rates helps teams tune detection rules without weakening coverage.

A malicious event that goes undetected because no rule, sensor, or analyst flagged it. Reducing false negatives usually requires layered detection, threat hunting, and review of missed incidents after the fact.

A proactive, hypothesis-driven search through networks and endpoints for hidden adversary activity that existing detections have not caught. It differs from alert monitoring because it begins with analyst hypotheses rather than automated triggers.

A scheme that rates incidents by business impact, scope, and urgency so resources are applied proportionally. Common schemes use tiers such as low, medium, high, and critical, each tied to specific response and notification requirements.

The phase focused on limiting the spread and impact of an incident while preserving evidence and keeping critical business functions running. Strategies range from short-term isolation of affected systems to longer-term segmentation and blocking.

Disconnecting or restricting a compromised system from other systems and networks to stop lateral movement. Isolation must be done carefully so that volatile evidence and remote access needed for investigation are not destroyed.

Dividing a network into separate zones with controlled traffic between them so that a compromise in one area cannot spread freely. Segmentation is both a preventive control and a containment tool during active incidents.

The phase in which the root cause and all malicious components of an incident are removed, such as malware, attacker accounts, and persistence mechanisms. It must address the initial access vector, or the incident is likely to recur.

The phase of restoring affected systems and services to normal operation in a controlled, verified way after eradication. It includes validation testing, heightened monitoring, and a phased return to production.

Techniques an attacker uses to keep access across reboots, credential changes, or cleanup efforts, such as scheduled tasks, services, or implanted accounts. Finding and removing persistence is essential before declaring eradication complete.

The disciplined process of identifying, collecting, preserving, and documenting digital evidence so it remains trustworthy and admissible. It relies on documented chain of custody and methods that avoid altering the original data.

A chronological record showing who collected, accessed, transferred, and stored each piece of evidence, along with when and why. Gaps or undocumented handling can undermine the credibility of evidence in legal or disciplinary proceedings.

A prioritization principle stating that the most perishable data, such as memory and network connections, should be captured before more durable data like disk contents. Following it preserves evidence that would otherwise disappear on shutdown or reboot.

A bit-for-bit copy of a storage device or memory space, created with tools that verify integrity through hashing. Investigators analyze the copy while the original is preserved as evidence.

Using a cryptographic hash, such as SHA-256, to prove that a forensic copy matches the original and has not been altered. Comparing hashes before and after acquisition supports the integrity of evidence.

The process of acquiring the contents of a system's volatile memory for analysis before powering it down. Memory can reveal running malware, encryption keys, and network connections that are absent from disk.

Reconstructing the sequence of events during an incident by correlating timestamps from logs, file system metadata, and other sources. A reliable timeline helps establish initial access, scope, and attacker actions in order.

The process of establishing which systems, accounts, and data an incident has affected, and how far the attacker has reached. Accurate scoping prevents premature recovery and guides containment and notification decisions.

The individual who leads the response effort, coordinates teams, makes or approves key decisions, and maintains a single point of accountability. The role is about coordination and decision-making rather than hands-on technical work.

A predefined set of audiences, channels, timing rules, and message owners for incident communications. It ensures that executives, technical teams, customers, and regulators receive consistent and appropriately timed information.

Informing affected or responsible parties, such as executives, customers, partners, or regulators, about an incident according to legal and contractual obligations. Messages must be accurate, approved, and consistent across audiences.

Formal reporting of an incident to government or industry bodies within legally mandated timeframes, such as privacy regulators or sector supervisors. Deadlines and content requirements vary by jurisdiction and data type.

A concise, regular update summarizing incident status, actions taken, current impact, and next steps for decision-makers. Consistent situation reports keep leadership informed without pulling responders into ad hoc briefings.

A structured post-incident review that identifies what worked, what failed, and what should change in plans, tools, or training. Findings should be assigned owners and tracked to closure so improvements are actually implemented.

A method for determining the underlying conditions that allowed an incident to occur, beyond the immediate trigger. Techniques such as the five whys or fault trees help distinguish root causes from contributing factors.

A written document produced after an incident that records the timeline, impact, response actions, findings, and recommended improvements. It serves as the formal record for leadership and as input to future planning.