Incident triage
Separate bad output, near misses and possible serious incidents.
Assess effects on health, safety, rights and relevant infrastructure.
A rights-related incident may be serious without a cyberattack. Use the statutory definition rather than a security-only severity scale.
Record facts, uncertainty and awareness times.