INTRA/MD/MD020Alert triage and case creation
The disposition of what the instruments raise: what is closed, what is held, and what becomes a case.
| Control | Jurisdiction | Source | What it establishes | Prerequisite or recommendation |
|---|---|---|---|---|
| MD020/EUMandatory | European Union | Commission Implementing Regulation (EU) 2024/2690European Commission · read 29 Aug 2026 | What the directive’s categories hold, in an annex setting out asset classification, the inventory, access control, privileged accounts, and removable media as requirements rather than as headings. | For the digital infrastructure and service providers it reaches, a suspicious event is assessed against criteria laid down in advance and against a triage that decides what is dealt with first. The relevant logs are reviewed for that assessment, and an event is reassessed and reclassified when new information arrives or when what was already held has been analyzed. |
| MD020/BEMandatory | Belgium | Convention collective de travail n° 81 du 26 avril 2002Conseil national du Travail · read 29 Aug 2026 | Four purposes for which network communication data may be monitored, collection in the aggregate rather than by name, and individualization as a separate operation with conditions of its own. | Collecting and naming are two operations. The convention calls the second individualization and governs it separately from the monitoring that produced the data. |
| Recommended | Norwaywhere written | NSMs grunnprinsipper for IKT-sikkerhet 2.1Nasjonal sikkerhetsmyndighet · read 29 Aug 2026 | A set of principles for securing information systems, with the monitoring ones carrying what the collected data may be used for, what employees are to be told about it, and the requirement to verify that the collection is working. | The log data are gone through and the relevant data about the event gathered to give a decision a basis, which may mean assembling data from several sources or running tests to confirm or rule out an event. The severity is then settled against the plan laid down in advance: whether it is a possible or a confirmed security incident or a false alarm, its class under the classification regime, which roles are brought in, and whether the contingency plan is triggered. |