Identify the generic origin and symptoms of the incident. (The cause of the incident may or may not be known.) This may not be the final categorization of the incident, but the initial categorization helps determine how to initially handle the incident. The categorization scheme is part of the Incident Management Framework.

Determine the appropriate incident model to use to provide specialist handling for that particular type of incident, for example the incident model detailing how to handle a security-type incident. Note: Regardless of the specialist incident model used, the Incident Management process governs the incident’s lifecycle phases.