Requirement
"The organization shall assess information security events and decide if they are to be categorized as information security incidents."[1]
Explanation
Information systems can log thousands of events not every event is an incident. The organization must define criteria for categorizing an event as an information security incident. This can be defined in the incident response plan.
