What it asks for. This control expects the organisation to assess information security events and decide whether they should be categorised as information security incidents. Its purpose is to make sure events are categorised and prioritised effectively.
In practice. Good practice means defined criteria and a categorisation and prioritisation scheme, so that triage staff can decide consistently whether an event is an incident, its severity and whom to involve. Decisions and their basis are recorded. Auditors look for the criteria, event and incident records showing the assessment and escalation consistent with the scheme.
Common gaps. Common gaps are unclear thresholds, events closed without recorded reasoning and criteria that do not consider regulatory reporting triggers. Triage decisions also often depend on the experience of one or two people.