I have been trying to find a definition of triage in relation to Information Security but cannot find any online. From the different examples given online (i.e. medical world), it seems related to determining the incidents priority/urgency and putting it in relation to your other issues.

Does this seem correct or is it something else?

  • Yes, it's the same general definition.
    – Xander
    Mar 14, 2016 at 13:07

2 Answers 2


Yes, it's not got a distinct meaning in information security - from dictionary.com:

the determination of priorities for action

So, deal with the most critical problems first, working down the list of known issues, trying to minimise the overall problems you can face.

Usually goes something along the lines of:

  1. Make sure no-one else can get into the system
  2. Take an image of the system
  3. Rebuild the system from known good
  4. Find out exactly what went wrong in great detail
  • 3
    I disagree that the four steps here constitute "triage" and that they should always be carried out in the order suggested. For me, its about identifying what needs to be done immediately (to limit further damage) and to determine the prioritization for full response.
    – symcbean
    Mar 14, 2016 at 13:42
  • @symcbean I don't think we're disagreeing the point here - it's a very high level idea of incident response triage, in a slightly tongue-in-cheek phrasing.
    – Matthew
    Mar 14, 2016 at 13:52
  • While I disagree that these 4 steps are what "triage" is, I do not think that is Matthew's point. Those are typical steps as part of the processes around triage. The main point is that 'triage' is about setting priorities.
    – schroeder
    Mar 19, 2017 at 11:08

detect, identify, notify these three are called Triage

  • 4
    As an Incident Response Manager, I do not think your list matches the industry expectations. Triage happens after detection and notification. It's about prioritization. Do you have a source for these 3 things being a definition of 'triage'?
    – schroeder
    Mar 19, 2017 at 11:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .