We've been asked to classify incidents using a 'taxonomy' — what is it, and why does it make responding harder?

Don't overcomplicate this. Just open a spreadsheet with columns for 'Date', 'Category', 'Severity Level', 'Affected Asset', and 'Action Taken'. You won't be logging thousands of rows a day; just document the actual incidents you had to actively handle on a weekly or monthly basis.

Two years ago we set up a taxonomy with 15 categories, and the team couldn't get any real work done from all the form-filling; our mean time to respond jumped from 30 minutes to 2 hours. Last year we cut it down to just 3 core categories, and our compliance rate hit 100%.

if you count every failed ssh attempt as an incident you'll be closing tickets until morning. just draw the line between a routine log and an incident for the taxonomy, the rest sorts itself out.

The real reason auditors and insurers want a taxonomy is to see if you can run a proper root-cause analysis when disaster strikes. If a data breach happens, they expect you to speak their language and say 'unauthorized access via social engineering' instead of 'the system broke.'

Here are the 3 golden filters you should follow when deciding to log something: 1) Was data integrity or confidentiality compromised, 2) Was customer-facing service disrupted, 3) Did it trigger a legal or contractual notification window? If the answer to all three is no, it's not an incident for your taxonomy, it's just a routine system log.

Does the insurer's application mandate a specific standard (like ISO 27035 or NIST SP 800-61), or are they just asking for a defined internal methodology? Usually, having your own clearly documented process is more than enough.

Big consulting firms hype this up as if a 5-person shop needs a 24/7 security operations center. In most vendor audits, the moment you show a clean, one-page matrix and say 'this is how we tag incidents,' they check the box and move on.

during our first audit we panicked and copied a 40-page NATO taxonomy document we found online but tbh the auditor literally laughed and asked, 'do you actually enforce this?' Simple is always the most credible way to go.

I have a question, don't want to go off-topic though. The real issue isn't the number, but what it's based on.

If I were you, I'd go this route.

I went through the same thing two years ago. Just because everyone does it doesn't mean it's right.

Hope this helps.

noted thanks.

Exactly, and not many people know this. Taking measures without an inventory leaves doors you haven't seen open.

You're right.

Sorry, but this doesn't apply in every case. If you get three different answers on a topic, the question was asked wrong.

Mistakes made on the cyber incident taxonomy side are usually reversible but expensive. This is my opinion, I'm not claiming it's absolute truth.

Timely topic.

There's a trap here, let me mention it. The harder it is to reverse a decision, the slower you should make it.

I felt relieved reading this answer, so it's not just me. Processes without records never improve, because you don't know what to fix.