← Back to catalogue
Published

Cyber Incident

vr.wm-act-020 · wm-act-020-cyber-incident

Represent an occurrence or linked set of occurrences determined to have actually or imminently compromised protected digital systems, information, services or computer-controlled infrastructure, together with evolving evidence-backed scope, impact and resolution facts.

World Models Activities and processes ACT.CYB
Bundle → Layer → Finding → QuestionsClassifiersWhat it isWhy it existsDistinguishing featuresWhat robots and AI may and may not doMoral aspectsOwnersLinks to other meta-modelsIdentity and identifiersDirect propertiesRecognitionCapabilities and actionsHazards and failure modesStandards and interfacesContext of useSources

Bundle → Layer → Finding → Questions Filled

7 bundles · 16 layers · 32 findings · 96 questions

Identity and determination Establishes the incident record, the qualification decision and identity continuity.

Incident identity

Stable identity, aliases and cross-system correlation.

Authoritative incident identity

The master-system identifier, record authority, version and namespace of the incident aggregate.

  1. What is currently asserted about authoritative incident identity for this cyber incident, and is it confirmed, suspected, disputed or unknown? identity
  2. Which source, observer or authority supports authoritative incident identity, at what event and observation times, and with what confidence? ownership
  3. Which validation, contradiction or change rule can revise authoritative incident identity without destroying its history? security

Aliases and correlation keys

Alternative incident identifiers, external references and bounded correlation keys used across organizations and tools.

  1. What is currently asserted about aliases and correlation keys for this cyber incident, and is it confirmed, suspected, disputed or unknown? interoperability
  2. Which source, observer or authority supports aliases and correlation keys, at what event and observation times, and with what confidence? constraint
  3. Which validation, contradiction or change rule can revise aliases and correlation keys without destroying its history? definition

Qualification and declaration

The evidence-based transition from reported event to declared incident.

Incident definition binding

The pinned organizational, statutory or profile definition against which the occurrence is qualified.

  1. What is currently asserted about incident definition binding for this cyber incident, and is it confirmed, suspected, disputed or unknown? classification
  2. Which source, observer or authority supports incident definition binding, at what event and observation times, and with what confidence? measurement
  3. Which validation, contradiction or change rule can revise incident definition binding without destroying its history? temporal

Qualification and declaration decision

The determination, authority, rationale, confidence and effective time for declaring, rejecting or revoking incident status.

  1. What is currently asserted about qualification and declaration decision for this cyber incident, and is it confirmed, suspected, disputed or unknown? decision
  2. Which source, observer or authority supports qualification and declaration decision, at what event and observation times, and with what confidence? validation
  3. Which validation, contradiction or change rule can revise qualification and declaration decision without destroying its history? process

Identity continuity

Duplicate resolution, merge, split, supersession and reopening.

Duplicate, merge and split

Governed relations and rationale when reports or event groups are deduplicated, merged into one incident or split into several incidents.

  1. What is currently asserted about duplicate, merge and split for this cyber incident, and is it confirmed, suspected, disputed or unknown? relationship
  2. Which source, observer or authority supports duplicate, merge and split, at what event and observation times, and with what confidence? retention
  3. Which validation, contradiction or change rule can revise duplicate, merge and split without destroying its history? privacy

Supersession and reopening

Identity-preserving rules for a corrected successor, revoked determination, recurring activity or reopened incident record.

  1. What is currently asserted about supersession and reopening for this cyber incident, and is it confirmed, suspected, disputed or unknown? lifecycle
  2. Which source, observer or authority supports supersession and reopening, at what event and observation times, and with what confidence? interoperability
  3. Which validation, contradiction or change rule can revise supersession and reopening without destroying its history? identity
Occurrence and chronology Represents constituent events, ordering and the distinct clocks by which an incident becomes known.

Constituent events

Incident membership and relationships among observed cyber events.

Event membership

References to cyber events accepted, suspected or rejected as constituents of the incident, with membership rationale.

  1. What is currently asserted about event membership for this cyber incident, and is it confirmed, suspected, disputed or unknown? composition
  2. Which source, observer or authority supports event membership, at what event and observation times, and with what confidence? identity
  3. Which validation, contradiction or change rule can revise event membership without destroying its history? spatial

Causal and sequence relations

Observed ordering, concurrency, dependency and claimed causal links among incident events without promoting hypotheses to facts.

  1. What is currently asserted about causal and sequence relations for this cyber incident, and is it confirmed, suspected, disputed or unknown? relationship
  2. Which source, observer or authority supports causal and sequence relations, at what event and observation times, and with what confidence? state
  3. Which validation, contradiction or change rule can revise causal and sequence relations without destroying its history? event

Incident time

Occurrence, detection, observation, declaration and knowledge times.

Temporal markers

Distinct start, end, detection, report, declaration, recovery, observation and ingestion timestamps with uncertainty.

  1. What is currently asserted about temporal markers for this cyber incident, and is it confirmed, suspected, disputed or unknown? temporal
  2. Which source, observer or authority supports temporal markers, at what event and observation times, and with what confidence? spatial
  3. Which validation, contradiction or change rule can revise temporal markers without destroying its history? retention

Ongoing, imminent and recurring occurrence

Whether compromise is ongoing, imminent, intermittent or recurring, including the evidence and interval basis.

  1. What is currently asserted about ongoing, imminent and recurring occurrence for this cyber incident, and is it confirmed, suspected, disputed or unknown? state
  2. Which source, observer or authority supports ongoing, imminent and recurring occurrence, at what event and observation times, and with what confidence? ownership
  3. Which validation, contradiction or change rule can revise ongoing, imminent and recurring occurrence without destroying its history? classification
Affected scope Describes direct and propagated reach using governed references and explicit assertion status.

Affected subjects

Directly affected technical and organizational subjects.

Affected systems, services and networks

References to systems, services, networks, accounts and computer-controlled infrastructure with role and affected interval.

  1. What is currently asserted about affected systems, services and networks for this cyber incident, and is it confirmed, suspected, disputed or unknown? relationship
  2. Which source, observer or authority supports affected systems, services and networks, at what event and observation times, and with what confidence? constraint
  3. Which validation, contradiction or change rule can revise affected systems, services and networks without destroying its history? provenance

Affected information, identities and parties

References and bounded counts for information, records, credentials, people and organizations affected or exposed.

  1. What is currently asserted about affected information, identities and parties for this cyber incident, and is it confirmed, suspected, disputed or unknown? privacy
  2. Which source, observer or authority supports affected information, identities and parties, at what event and observation times, and with what confidence? measurement
  3. Which validation, contradiction or change rule can revise affected information, identities and parties without destroying its history? evidence

Scope reach and certainty

Dependency propagation and changing confidence in affected-scope claims.

Dependency and supply-chain reach

Potential or confirmed propagation through service, supplier, tenant, identity and data dependencies.

  1. What is currently asserted about dependency and supply-chain reach for this cyber incident, and is it confirmed, suspected, disputed or unknown? relationship
  2. Which source, observer or authority supports dependency and supply-chain reach, at what event and observation times, and with what confidence? validation
  3. Which validation, contradiction or change rule can revise dependency and supply-chain reach without destroying its history? access

Scope assertion status

Confirmed, suspected, disputed or disproven affected-scope assertions with assessor, method, confidence and history.

  1. What is currently asserted about scope assertion status for this cyber incident, and is it confirmed, suspected, disputed or unknown? quality
  2. Which source, observer or authority supports scope assertion status, at what event and observation times, and with what confidence? retention
  3. Which validation, contradiction or change rule can revise scope assertion status without destroying its history? composition
Security effect and impact Separates the security property affected from technical, operational, human and legal consequences.

Security effects

Compromised security properties and policy or legal violations.

Confidentiality, integrity, availability and authenticity

Observed or threatened compromise of security properties, affected objects, degree and supporting evidence.

  1. What is currently asserted about confidentiality, integrity, availability and authenticity for this cyber incident, and is it confirmed, suspected, disputed or unknown? security
  2. Which source, observer or authority supports confidentiality, integrity, availability and authenticity, at what event and observation times, and with what confidence? interoperability
  3. Which validation, contradiction or change rule can revise confidentiality, integrity, availability and authenticity without destroying its history? ownership

Policy, law and authority effect

The alleged or confirmed security-policy, acceptable-use, legal or lawful-authority condition implicated by the occurrence.

  1. What is currently asserted about policy, law and authority effect for this cyber incident, and is it confirmed, suspected, disputed or unknown? authority
  2. Which source, observer or authority supports policy, law and authority effect, at what event and observation times, and with what confidence? identity
  3. Which validation, contradiction or change rule can revise policy, law and authority effect without destroying its history? evidence

Impact domains

Consequences beyond the immediate technical effect.

Operational, safety and privacy impact

Service disruption, physical-safety implications and effects on rights or personal data, with actual versus potential status.

  1. What is currently asserted about operational, safety and privacy impact for this cyber incident, and is it confirmed, suspected, disputed or unknown? measurement
  2. Which source, observer or authority supports operational, safety and privacy impact, at what event and observation times, and with what confidence? relationship
  3. Which validation, contradiction or change rule can revise operational, safety and privacy impact without destroying its history? exception

Financial, societal and cross-border impact

Material and non-material damage, financial loss, constituency reach and cross-border effect assertions.

  1. What is currently asserted about financial, societal and cross-border impact for this cyber incident, and is it confirmed, suspected, disputed or unknown? measurement
  2. Which source, observer or authority supports financial, societal and cross-border impact, at what event and observation times, and with what confidence? temporal
  3. Which validation, contradiction or change rule can revise financial, societal and cross-border impact without destroying its history? relationship

Severity and significance

Profile-bound prioritization and regulatory classifications.

Severity assessment

Severity or priority value together with scheme, version, assessor, inputs, confidence and effective time.

  1. What is currently asserted about severity assessment for this cyber incident, and is it confirmed, suspected, disputed or unknown? classification
  2. Which source, observer or authority supports severity assessment, at what event and observation times, and with what confidence? ownership
  3. Which validation, contradiction or change rule can revise severity assessment without destroying its history? authority

Regulatory significance bindings

Jurisdiction and regime-specific determinations such as significant incident or personal-data breach, with threshold evidence and obligation reference.

  1. What is currently asserted about regulatory significance bindings for this cyber incident, and is it confirmed, suspected, disputed or unknown? requirement
  2. Which source, observer or authority supports regulatory significance bindings, at what event and observation times, and with what confidence? constraint
  3. Which validation, contradiction or change rule can revise regulatory significance bindings without destroying its history? quality
Mechanism and attribution Records evidence-backed causal, exploit, technique and actor assertions without absorbing neighboring security-object lifecycles.

Cause and exploit

Root-cause hypotheses and referenced weaknesses or exposures.

Cause and enabling-condition hypotheses

Competing root-cause, misconfiguration, failure, human-action and enabling-condition hypotheses with evidence and confidence.

  1. What is currently asserted about cause and enabling-condition hypotheses for this cyber incident, and is it confirmed, suspected, disputed or unknown? provenance
  2. Which source, observer or authority supports cause and enabling-condition hypotheses, at what event and observation times, and with what confidence? measurement
  3. Which validation, contradiction or change rule can revise cause and enabling-condition hypotheses without destroying its history? interoperability

Vulnerability and exposure references

References to exploited or suspected vulnerabilities and concrete exposures without owning disclosure, scoring or remediation state.

  1. What is currently asserted about vulnerability and exposure references for this cyber incident, and is it confirmed, suspected, disputed or unknown? relationship
  2. Which source, observer or authority supports vulnerability and exposure references, at what event and observation times, and with what confidence? validation
  3. Which validation, contradiction or change rule can revise vulnerability and exposure references without destroying its history? state

Technique, indicator and attribution

Observed mechanisms and bounded claims about responsible activity.

Technique, indicator and observable references

References to attack patterns, indicators, observables, tools and infrastructure with observed role and time.

  1. What is currently asserted about technique, indicator and observable references for this cyber incident, and is it confirmed, suspected, disputed or unknown? evidence
  2. Which source, observer or authority supports technique, indicator and observable references, at what event and observation times, and with what confidence? retention
  3. Which validation, contradiction or change rule can revise technique, indicator and observable references without destroying its history? requirement

Actor, campaign and attribution claims

Competing links to actors, campaigns or intrusion sets with source, analytic basis, confidence and disclosure marking.

  1. What is currently asserted about actor, campaign and attribution claims for this cyber incident, and is it confirmed, suspected, disputed or unknown? provenance
  2. Which source, observer or authority supports actor, campaign and attribution claims, at what event and observation times, and with what confidence? interoperability
  3. Which validation, contradiction or change rule can revise actor, campaign and attribution claims without destroying its history? validation
Evidence, provenance and governance Makes observations, evidence references, epistemic status and controlled disclosure explicit.

Observations and evidence

Source reports, technical observations and preserved evidence bindings.

Reports, observations and discovery

Source reports, discovery methods, observations, sensor or analyst provenance, reliability and observation conditions.

  1. What is currently asserted about reports, observations and discovery for this cyber incident, and is it confirmed, suspected, disputed or unknown? provenance
  2. Which source, observer or authority supports reports, observations and discovery, at what event and observation times, and with what confidence? identity
  3. Which validation, contradiction or change rule can revise reports, observations and discovery without destroying its history? decision

Evidence integrity and custody references

References to forensic artifacts and custody records with digest, collector, preservation state and access boundary.

  1. What is currently asserted about evidence integrity and custody references for this cyber incident, and is it confirmed, suspected, disputed or unknown? evidence
  2. Which source, observer or authority supports evidence integrity and custody references, at what event and observation times, and with what confidence? relationship
  3. Which validation, contradiction or change rule can revise evidence integrity and custody references without destroying its history? lifecycle

Epistemic and disclosure controls

Truth status, markings, access, retention and projections.

Fact, assessment, allegation and unknown

Explicit epistemic status for each material assertion, including contradiction sets and the authority able to resolve them.

  1. What is currently asserted about fact, assessment, allegation and unknown for this cyber incident, and is it confirmed, suspected, disputed or unknown? quality
  2. Which source, observer or authority supports fact, assessment, allegation and unknown, at what event and observation times, and with what confidence? temporal
  3. Which validation, contradiction or change rule can revise fact, assessment, allegation and unknown without destroying its history? constraint

Disclosure, access, privacy and retention

Information marking, permitted projection, privacy constraints, legal hold and retention or deletion binding.

  1. What is currently asserted about disclosure, access, privacy and retention for this cyber incident, and is it confirmed, suspected, disputed or unknown? access
  2. Which source, observer or authority supports disclosure, access, privacy and retention, at what event and observation times, and with what confidence? ownership
  3. Which validation, contradiction or change rule can revise disclosure, access, privacy and retention without destroying its history? security
State, resolution and federation Tracks incident-owned factual state and closure while connecting external response cases and exchange representations.

Incident state and resolution

Current incident condition, impact cessation and residual exposure.

Incident factual state

Profile-bound incident state, allowed transition, triggering evidence, actor and effective time, separate from response-task status.

  1. What is currently asserted about incident factual state for this cyber incident, and is it confirmed, suspected, disputed or unknown? state
  2. Which source, observer or authority supports incident factual state, at what event and observation times, and with what confidence? constraint
  3. Which validation, contradiction or change rule can revise incident factual state without destroying its history? definition

Impact cessation, residual exposure and recurrence

Evidence that harmful effects ceased or persist, remaining exposure, recurrence indicators and uncertainty.

  1. What is currently asserted about impact cessation, residual exposure and recurrence for this cyber incident, and is it confirmed, suspected, disputed or unknown? validation
  2. Which source, observer or authority supports impact cessation, residual exposure and recurrence, at what event and observation times, and with what confidence? measurement
  3. Which validation, contradiction or change rule can revise impact cessation, residual exposure and recurrence without destroying its history? temporal

Closure and external bindings

Closure basis, response-case linkage and exchange mappings.

Closure, reclassification and disposition

The evidence-backed decision to close, revoke, reclassify or reopen the incident and its unresolved facts or obligations.

  1. What is currently asserted about closure, reclassification and disposition for this cyber incident, and is it confirmed, suspected, disputed or unknown? lifecycle
  2. Which source, observer or authority supports closure, reclassification and disposition, at what event and observation times, and with what confidence? validation
  3. Which validation, contradiction or change rule can revise closure, reclassification and disposition without destroying its history? process

Response-case and federation bindings

References to response cases, reporting workflows and external incident representations with mapping, projection and correlation rules.

  1. What is currently asserted about response-case and federation bindings for this cyber incident, and is it confirmed, suspected, disputed or unknown? interoperability
  2. Which source, observer or authority supports response-case and federation bindings, at what event and observation times, and with what confidence? retention
  3. Which validation, contradiction or change rule can revise response-case and federation bindings without destroying its history? privacy

Classifiers Filled

Family
World Models
Category
Activities and processes
Entry kind
aggregate
Navigation path
NAV.ACT.CYB
Domain
ACT.CYB
Industry
Cross-industry
Tags
cyberincidentact.cyb
Also called
S8

What it is Filled

Owns incident identity, qualification, constituent-event grouping, chronology, affected-scope assertions, security effects, impact assessments, hypotheses, factual state, evidence indexes, disclosure controls and closure decisions while referencing response workflow and neighboring security objects.

In scope

  • Incident identity, qualification authority, chronology, affected scope, security effects, impact and factual lifecycle
  • Evidence-backed cause and attribution hypotheses, incident-owned assessments, external bindings and controlled projections
  • Typed references to vulnerabilities, events, indicators, actors, systems, evidence and response cases

Out of scope

  • Incident-response workflow, responder tasks, containment or recovery execution, notifications, playbooks and lessons-learned processes
  • Vulnerability disclosure, scoring and remediation lifecycle or the lifecycle of threats, indicators, controls, assets, people and organizations
  • Generic evidence custody, access enforcement, audit persistence and legal adjudication beyond incident-local bindings

Why it exists Filled

Represent an occurrence or linked set of occurrences determined to have actually or imminently compromised protected digital systems, information, services or computer-controlled infrastructure, together with evolving evidence-backed scope, impact and resolution facts.

Distinguishing features Filled

  • An incident is a qualified grouping of events with assessed security effects, not a single alert.
  • Holds chronology, impact and hypotheses but not the response workflow that contains or recovers.
  • Separate from a vulnerability, which is a weakness that may or may not have been exploited.
  • A personal-data breach is a legal determination that may follow from an incident, not the same record.

What robots and AI may and may not do Filled

Must not

  • Declare an incident closed or a breach non-reportable without the accountable role.
  • Alter or delete evidence references or the incident chronology.
  • Disclose incident details to parties outside the approved disclosure list.
  • Contact or counter-attack suspected attackers.
  • Present an unconfirmed hypothesis about cause or attribution as fact.

Only with a human decision

  • Declaring a major incident and its severity.
  • Deciding on regulatory or personal-data breach notification.
  • Attributing an incident to a named actor.

May

  • Group related alerts into a candidate incident with a timeline.
  • Record affected assets, effects and impact assessments with their evidence references.
  • Draft notifications for review by the responsible officer.
  • Mark hypotheses as confirmed or rejected as evidence arrives.

Moral aspects Filled

  • Incident records often contain personal data of victims and staff; access should be strictly limited.
  • Premature attribution can harm innocent individuals or organizations.
  • Affected people have an interest in timely notification so they can protect themselves.
  • Blame-focused records discourage honest reporting of mistakes.

Who is affected

  • People whose data or services were affected
  • Staff involved in or reporting the incident
  • Regulators and partners receiving notifications

Owners Filled

Steward

Declare the Dimension owner, incident record authority, constituency, stewards and declaration or closure delegation.

Roles

Dimension owner
Own incident namespace, mastership, profile selection, delegation, access and retention policy.
Incident authority
Qualify, declare, merge, split, reclassify, close or reopen incidents within mandate.
Incident analyst
Maintain chronology, scope, impact, hypotheses, confidence and supporting references without overstating certainty.
Evidence custodian
Preserve external evidence identity, integrity, custody and access references without transferring mastership into the incident record.
Response coordinator
Bind the independently governed response case and communicate factual updates without editing evidence authority.
Privacy or legal reviewer
Evaluate personal-data, regulatory, disclosure, retention and legal-hold bindings.
Auditor
Review decisions, provenance, changes, access and unresolved contradictions without rewriting operational truth.

Links to other meta-models Filled

references

  • WM-SFT-006 Vulnerability Record - Binds exploited or suspected vulnerabilities and exposures without copying vulnerability lifecycle, scoring or remediation state.
  • WM-ACT-042 Incident Response - Links the independently governed handling case and keeps response execution outside the incident factual aggregate.
  • Cyber event, observation and evidence models - Groups incident-local membership and provenance assertions while external records own raw event and evidence lifecycles.
  • System, service, network, information, identity, person and organization models - Expresses affected scope through authoritative identities without duplicating direct properties or mastership.
  • Threat actor, campaign, attack pattern, indicator and observable models - Carries evidence-backed incident-local attribution and mechanism links without owning CTI object lifecycles.
  • NIS2 and GDPR obligation profiles - Binds regime-specific classification and reporting obligations while keeping legal workflow outside the incident model.

aligned

  • NIST SP 800-61 Rev. 3 and FIRST CSIRT Services Framework - Aligns qualification, analysis and response boundaries without treating guidance as a storage schema.
  • IODEF Version 2 and STIX Version 2.1 - Supports explicit, potentially lossy exchange mappings with version and marking preservation.

neighbor

  • Cyber event or alert - An event or alert is an observation or signal; a cyber incident is a qualified occurrence aggregate that meets a pinned definition and carries a governed declaration decision.
  • Cyber incident response - The incident represents what happened and what is currently known; response cases, tasks and mitigation or recovery execution are independently governed and linked by reference.
  • Vulnerability or exposure - A vulnerability or exposure may enable an incident, but its disclosure, scoring, affected-version and remediation lifecycle stays in WM-SFT-006 or another authoritative security model.
  • Personal-data breach or significant incident - These are regime-specific classifications of facts and impact; the incident stores a versioned determination binding but does not own the reporting workflow or legal conclusion lifecycle.
  • STIX Incident - STIX 2.1 provides a deliberately limited Incident extension point, so Vercy aligns exchange identity and markings without claiming that the STIX stub defines this full logical model.

What else AI and robots need to interact with it Filled

Identity and identifiers required Filled

  • Authoritative master-system incident identifier and immutable revision identifier.
  • Governed globally resolvable incident IRI or federation identifier.
  • Adopting-Dimension UUID or ULID when no authoritative external identifier exists.

Direct properties not applicable Not applicable

Not applicable

Institutional or informational subject: no invented physical properties.

Recognition optional Filled

  • A cyber incident has an identifier, a qualification decision, grouped events, a timeline, affected scope and assessed effects.
  • It is confused with a security alert, a vulnerability record and a service outage ticket.

Capabilities and actions required Filled

  • Register potential incident: Create a non-confirmed incident candidate from a report or event cluster without claiming qualification.
  • Qualify and declare incident: Evaluate the candidate against a pinned definition and record the authorized determination.
  • Link constituent event: Add or remove a typed event membership assertion with evidence and historical trace.
  • Merge or split incident: Resolve duplicate or over-grouped incident identities without losing prior references.
  • Revise affected scope: Add, confirm, dispute or remove an affected-scope assertion as knowledge changes.
  • Assess impact and significance: Record technical and nontechnical impact, severity and profile-specific significance without universalizing a score.
  • Record causal or attribution hypothesis: Add an evidence-backed, confidence-bearing explanation or attribution without promoting it to fact.
  • Transition incident factual state: Change the incident-owned condition under a pinned state profile and triggering evidence.
  • Bind response case: Reference the independently governed incident-response case that handles this incident.
  • Issue incident projection: Produce a minimum authorized view for coordination, reporting or threat-intelligence exchange.

Hazards and failure modes required Filled

  • Missed legal notification deadlines.
  • Evidence spoiled or tampered with during handling.
  • Leak of incident details that helps the attacker.
  • Wrong attribution that damages relations or reputations.

Standards and interfaces required Filled

  • OASIS STIX 2.1 and TAXII 2.1.
  • VERIS incident classification framework.
  • ISO/IEC 27035 information security incident management.
  • FIRST Traffic Light Protocol (TLP) 2.0 for sharing limits.

Context of use required Filled

  • NIS2 and GDPR bindings apply only where the relevant European Union law and local implementation govern the incident; no universal reporting deadline or legal conclusion is assumed.
  • NIST terminology is used as an authoritative profile, not as a claim that United States legal definitions apply globally.

Sources Filled

  1. NIST SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management - National Institute of Standards and Technology
  2. Computer Security Incident glossary entry - National Institute of Standards and Technology
  3. RFC 7970: The Incident Object Description Exchange Format Version 2 - Internet Engineering Task Force
  4. STIX Version 2.1 - OASIS Open
  5. CSIRT Services Framework Version 2.1 - Forum of Incident Response and Security Teams
  6. Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union - European Union
  7. Regulation (EU) 2016/679 General Data Protection Regulation - European Union

Open questions

  • Validate the logical structure against current CSIRT, SOC, cloud, operational-technology, healthcare, financial-sector and public-authority incident profiles.
  • Create clause-level crosswalks for IODEF Version 2, STIX incident extensions, national NIS2 implementations and regulator reporting schemas.
  • Pin sibling model identifiers and cardinality contracts for events, observations, evidence, affected assets, CTI objects, legal obligations and response cases.
  • Review generated question wording with incident handlers, forensic specialists, privacy officers and operational-risk owners.
  • Sector, organization and jurisdiction profiles must supply exact event, incident-state, severity, significance, reporting and closure vocabularies.
  • The exact identifiers and dependency contracts for event, evidence, affected-object, threat-intelligence, legal-obligation and response-case sibling models remain to be pinned as the catalogue matures.
  • Clause-level mappings to IODEF, STIX extensions, national NIS2 implementations and regulator reporting schemas remain profile work.

Machine files

Card as JSON Specification AGENTS.md Source Card backlog vercy.card/1

Provenance

world-models research · reviewable-draft

Built from: models/wm-act-020-cyber-incident/spec.yaml, ver-cy/world-models/card-supplements/wm-act-020-cyber-incident.json