The organisation should determine the criteria that classify incidents needing special treatment, such as heightened confidentiality, and should establish a process by which such an incident is either passed to specialist security personnel or run jointly by the service incident staff and the security staff. Some security incidents, for instance an internal breach needing police investigation and forensic examination, should be handled by the information security function rather than the incident or major incident procedure, with visibility limited to a small group; procedures can set the criteria for that transfer, and the investigation skills differ from other incident types. Because of the sensitivity of some security incident records, access to view or update them should be limited to personnel with the appropriate clearance or authorisation.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.