INTRA/IV/IV002Case intake and triage
The assessment of what arrives, from any route, against a threshold for opening a case.
| Control | Jurisdiction | Source | What it establishes | Prerequisite or recommendation |
|---|---|---|---|---|
| Recommended | Belgiumwhere written | CyberFundamentals 2025, EssentialCentre for Cybersecurity Belgium · read 29 Aug 2026 | What the Belgian centre sets out for the heaviest of its assurance levels, and the only place in this record where a national authority names the insider as something the detection tools are there to catch. | The criteria for categorizing, prioritizing, and escalating are documented in the response plan and applied consistently, and the indicators that guide the prioritizing are named as the scope, the severity, and how time sensitive the matter is. |
| Recommended | United Kingdomwhere written | Insider Data Collection Study: Report of Main FindingsNPSA, published as CPNI · read 11 Aug 2026 | How real insider acts occurred and what preceded them, from a review of United Kingdom cases. | The threshold has real cases to be set against: how the acts occurred and what preceded them, in a national population now some years old. |