Right now, there is ongoing work on EU level to harmonize how we classify incidents. This stems from multiple legal backgrounds, including the NIS2 directive and it’s reporting requirements and the Blueprint for cyber crisis management.

I’ve tried to give input to most of these initiatives, and in most of these cases, we’ve been moving in the right direction. Not everything is perfect, thus I’d like to write a couple of lines on how I think the whole topic should be addressed.

The main point is that there are multiple independent dimensions to an incident. Packing everything into one single attribute is thus a mistake. Just as in journalism, the best way to approach this topic is by looking at the questions you should ask about an incident.

What happened?

The first dimension is the category of the incident on a high level. Was this an APT-style spying operation? A financially motivated ransomware attack? A DDoS-attack disrupting operations?

The RSIT is a good starting point. It provides high-level categories and a second level to provide more detail. See also parameter O-8 in the "SIM3 v2 interim" model.

Why did it happen?

This is usually called the “root-cause” of the incident. That can be 0-day vulnerability in an Internet-facing device, social engineered malware installation (e.g., ClickFix), hardware failure, human error, and dozens of other reasons.

For these first two dimensions, I strongly recommend allowing only a single value, even if there are multiple ones that could fit. It makes the data model simpler and the statistics a lot easier to display and explain. If you allow multiple root-causes, then the numbers over the categories don’t add up to the number of incidents and you no longer are able to use pie-charts.

How bad is it?

The impact of the incident may vary from a minor outage to a full-blown network compromise with loss of all data. It might make sense to differentiate between the direct technical issue and the effect this IT incident has on the company and its customers.

The EU blueprint for cyber crisis management has tasked the CyCLONe network to come up with a severity scale for this question.

My ambition for this process was to find something analogous to the Saffir-Simpson Hurricane Wind Scale for hurricanes or the Richter Scale for earthquakes. In other words, something simple that both politicians and the public can understand and base decisions on.