<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: implementing-incident-classification-framework
description: >-
  Define and implement incident classification taxonomies covering NIST SP 800-61
  categories, functional impact ratings, information impact ratings, and recoverability
  effort levels to ensure consistent triage and accurate severity assignment.
domain: cybersecurity
subdomain: incident-management
tags:
  - classification
  - taxonomy
  - nist-800-61
  - triage
  - categorization
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["TA0001", "TA0040"]
  nist-csf: ["RS.AN-1", "RS.RP-1"]
  frameworks: ["NIST SP 800-61", "ISO 27035"]
---

# Implementing Incident Classification Framework

## Overview

A classification framework provides a shared vocabulary for categorizing
incidents by type, functional impact, information impact, and recoverability.
Consistent classification drives accurate severity assignment, appropriate
resource allocation, and meaningful trend analysis.

## Prerequisites

| Requirement | Purpose |
|---|---|
| NIST SP 800-61 Rev 2 | Category definitions |
| Asset inventory | Criticality-based impact scoring |
| Business impact analysis | Functional impact ratings |
| Ticketing system API | Automated category enforcement |

## Classification Taxonomy

### NIST SP 800-61 Categories

```
CATEGORY TAXONOMY:
├── CAT-1: Unauthorized Access
│   ├── Compromised credentials
│   ├── Privilege escalation
│   └── Unauthorized system access
├── CAT-2: Denial of Service
│   ├── Volumetric DDoS
│   ├── Application-layer DoS
│   └── Resource exhaustion
├── CAT-3: Malicious Code
│   ├── Ransomware
│   ├── Trojan / RAT
│   ├── Worm / self-propagating
│   └── Cryptominer
├── CAT-4: Improper Usage
│   ├── Policy violation
│   ├── Acceptable use breach
│   └── Shadow IT
├── CAT-5: Scans / Probes / Reconnaissance
│   ├── Port scanning
│   ├── Vulnerability scanning
│   └── Social engineering attempts
└── CAT-6: Investigation
    ├── Unconfirmed suspicious activity
    └── Threat intelligence indicator match
```

### Functional Impact Ratings

| Rating | Definition | Examples |
|--------|-----------|----------|
| **NONE** | No impact to functionality | Blocked scan, failed phish |
| **LOW** | Minimal impact, workaround exists | Single workstation malware |
| **MEDIUM** | Noticeable impact, degraded service | Email delay, VPN partial outage |
| **HIGH** | Critical function unavailable | Prod database offline, auth down |

### Information Impact Ratings

| Rating | Definition | Examples |
|--------|-----------|----------|
| **NONE** | No data compromise | Blocked exfiltration attempt |
| **SUSPECTED** | Indicators but unconfirmed | Anomalous egress traffic spike |
| **CONFIRMED** | Data confirmed exposed | Exfiltrated database dump found |
| **INTEGRITY** | Data modified maliciously | Tampered audit logs, defacement |

### Recoverability Effort

| Level | Definition | Timeframe |
|-------|-----------|-----------|
| **Regular** | Recoverable with existing resources | < 24 hours |
| **Supplemented** | Requires additional resources | 1–7 days |
| **Extended** | Requires significant resources | > 7 days |
| **Not Recoverable** | Permanent loss or damage | N/A |

## Implementation

### Ticketing System Integration

```python
REQUIRED_FIELDS = {
    "category": ["CAT-1", "CAT-2", "CAT-3", "CAT-4", "CAT-5", "CAT-6"],
    "functional_impact": ["NONE", "LOW", "MEDIUM", "HIGH"],
    "information_impact": ["NONE", "SUSPECTED", "CONFIRMED", "INTEGRITY"],
    "recoverability": ["REGULAR", "SUPPLEMENTED", "EXTENDED", "NOT_RECOVERABLE"],
}

def validate_classification(ticket: dict) -> list[str]:
    errors = []
    for field, valid_values in REQUIRED_FIELDS.items():
        value = ticket.get(field)
        if not value:
            errors.append(f"Missing required field: {field}")
        elif value not in valid_values:
            errors.append(f"Invalid {field}: {value}")
    return errors
```

### Auto-Classification Rules

```yaml
auto_classify:
  - match:
      alert_type: "ransomware_*"
    classify:
      category: CAT-3
      functional_impact: HIGH
      information_impact: INTEGRITY
      recoverability: EXTENDED

  - match:
      alert_type: "brute_force_*"
      success: false
    classify:
      category: CAT-5
      functional_impact: NONE

  - match:
      alert_type: "data_exfiltration_*"
    classify:
      category: CAT-1
      information_impact: SUSPECTED
```

## Workflow

Follow the structured procedure outlined in Key Concepts above.

## Verification

- [ ] All NIST 800-61 categories represented in taxonomy
- [ ] Functional and information impact ratings documented
- [ ] Ticketing system enforces required classification fields
- [ ] Auto-classification rules cover top 10 alert types
- [ ] Analysts trained on classification criteria
