Decision Gate
Definition
A checkpoint within a playbook at which the responder must evaluate a condition, such as whether data exfiltration has been confirmed, and choose one of two or more defined paths forward. Decision gates prevent responders from skipping critical assessments under time pressure.
- Location
- Embedded within an incident response playbook
- Function
- Forces evaluation of a condition before proceeding
- Example condition
- Whether data exfiltration has been confirmed
- Outcome
- Branches responder to one of two or more defined paths
- Purpose
- Prevents skipped assessments under time pressure
Common questions
Why do incident response playbooks need explicit decision gates rather than a simple linear checklist?+
A linear checklist assumes every incident follows the same path, but real incidents branch, for example containment steps differ sharply depending on whether data left the network. Decision gates force the responder to make and record that determination before the playbook lets them proceed down a specific branch.
What happens if a responder cannot confidently answer a decision gate's condition?+
Playbooks typically instruct the responder to default to the more conservative path, such as treating an unconfirmed exfiltration as confirmed for containment purposes, until further evidence resolves the uncertainty, rather than guessing or delaying the response.
Related terms
- Indicators of Compromise (IoCs)
- Artefacts observed on a network or system that suggest an intrusion or malicious activity has occurred, such as unusual outbound connections, known-malicious...
- Playbook
- A documented step-by-step procedure for responding to a specific type of security event. Playbooks standardise analyst behaviour, reduce response time, and ensure...
- Runbook
- A technical execution document, sometimes used interchangeably with playbook but more precisely refers to the low-level commands and scripts used during a...
- SOAR
- Security Orchestration, Automation and Response. A platform that can execute playbook steps automatically, such as blocking an IP address or disabling a...
- Tabletop Exercise
- A structured, discussion-based simulation in which team members walk through a hypothetical incident using the playbook as a guide, without touching live...