Processes are established to receive, analyze and respond to vulnerabilities disclosed to the organization from internal and external sources (e.g., internal testing, security bulletins, or security researchers).

Incidents are categorized consistent with response plans.

Forensic data is collected.

The impact of the incident is understood.

Notifications from detection systems are investigated