Phase Granularity
Definition
The number and specificity of discrete steps a framework defines within the IR lifecycle. Higher granularity, as in SANS PICERL's six steps versus NIST's four phases, supports more precise status tracking during complex incidents but can add overhead in smaller teams.
- Concept
- Number of discrete steps a framework defines in the IR lifecycle
- SANS PICERL
- Six defined steps
- NIST framework
- Four defined phases
- Tradeoff
- Precision of status tracking versus process overhead
Common questions
Which level of phase granularity suits a small incident response team?+
Smaller teams generally do better with fewer, broader phases like NIST's four-phase model, since a finer-grained framework can demand documentation and handoffs the team lacks the staffing to maintain during an active incident.
Does higher phase granularity change how a framework maps to compliance requirements?+
A more granular framework can make it easier to demonstrate that each specific regulatory or contractual control was addressed at a distinct step, but it does not change the underlying compliance obligations, only how explicitly the response documentation aligns with them.
Related terms
- CREST
- A UK-based not-for-profit professional body that publishes practitioner-focused incident response guidelines and operates accreditation schemes for IR service providers. CREST guidance emphasises...
- Framework Blending
- The practice of combining elements of multiple IR frameworks: for example, using NIST as the strategic backbone, SANS phase names in operational...
- ISO/IEC 27035
- An international standard for information security incident management. Part 1 covers principles and concepts; Part 2 covers planning and preparation. It defines...
- NIST SP 800-61
- The US National Institute of Standards and Technology's Computer Security Incident Handling Guide. It defines a four-phase IR lifecycle: Preparation; Detection and...
- SANS PICERL
- A six-step incident response model developed through SANS Institute training: Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned. PICERL breaks NIST's combined response...