If Incident Management is about orchestrating the response, then Incident Analysis is about making sure you are responding to the right problem.
I’ve seen organizations execute incident response plans flawlessly—only to later discover they misunderstood what actually happened. They contained the wrong systems, preserved the wrong evidence, and briefed executives with incomplete narratives.
That is why NIST CSF 2.0 Respond – Incident Analysis (RS.AN) is a distinct and critical category. It exists to ensure that decisions made during response are grounded in accurate, evolving understanding of the incident.
What Is Incident Analysis (RS.AN) in NIST CSF 2.0?
RS.AN focuses on the organization’s ability to investigate and analyze cybersecurity incidents to understand cause, scope, impact, and attacker behavior.
Put simply, RS.AN answers:
“What actually happened, how did it happen, and what does it mean?”
Incident analysis builds on detection and adverse event analysis, but goes further by:
Confirming root cause
Determining the full blast radius
Identifying attacker objectives and progression
Validating containment and eradication decisions
Without strong analysis, response becomes guesswork.
Why Incident Analysis Matters to CISOs
From an executive perspective, incident analysis drives:
Correct containment decisions
Regulatory and legal accuracy
Credible executive and board briefings
Lasting security improvements
Poor analysis leads to:
Incomplete containment
Repeated incidents
Incorrect disclosures
Loss of trust with leadership and regulators
Analysis is what turns activity into understanding.
Core Objectives of RS.AN
A mature Incident Analysis capability ensures that:
Incidents are fully understood, not just closed
Root causes are identified and validated
Scope and impact estimates improve over time
Response actions are continuously adjusted based on evidence
This is a dynamic process, not a one-time task.
How to Implement RS.AN Effectively
1. Separate Analysis From Initial Triage
Early triage is about speed. Incident analysis is about accuracy.
RS.AN requires deliberate investigation focused on:
Timeline reconstruction
Evidence validation
Hypothesis testing
Peer review of conclusions
Aspiring CISOs should ensure analysts are given time and authority to analyze—not just react.
2. Preserve and Correlate Evidence Early
Analysis depends on evidence quality.
Organizations should ensure:
Log retention is sufficient
Forensic artifacts are preserved
Cloud, identity, and endpoint data are correlated
Chain-of-custody procedures exist when needed
You cannot analyze what you didn’t collect.
3. Understand Adversary Behavior and Intent
RS.AN is not just technical troubleshooting.
Effective programs:
Map activity to attack techniques
Assess attacker objectives
Identify pivot points and missed detections
Understand how the attacker entered, moved, and persisted
This prevents repeating the same failures.
4. Continuously Re-Assess Scope and Impact
One of the most common response failures is locking into an early conclusion.
Strong RS.AN practices include:
Expanding scope checks proactively
Re-validating containment effectiveness
Updating executives as understanding evolves
Adjusting response actions based on new findings
Analysis should evolve as the incident evolves.
5. Feed Analysis Directly Into Improvement
RS.AN findings must directly influence:
Detection tuning
Control gaps
Architectural changes
Training priorities
Risk assessments
If analysis does not change the program, it is purely academic.
Metrics to Measure Incident Analysis Effectiveness
Operational Metrics
Time to confirmed root cause
Analysis backlog per incident
Evidence completeness rate
Analyst peer review frequency
Effectiveness Metrics
Incidents with validated root causes
Scope expansions after initial analysis
Missed detection points identified
Repeated incidents tied to known causes
Maturity Metrics
% of incidents with formal analysis reports
% of incidents with attacker TTP mapping
Time between containment and full understanding
Executive confidence ratings post-incident
Strong metrics emphasize confidence and correctness, not just speed.
Common RS.AN Pitfalls
These issues consistently weaken programs:
Rushing analysis to “close” incidents
Over-trusting automated conclusions
Failing to reassess assumptions
Not involving experienced analysts
Treating analysis as post-incident only
Incident analysis should run in parallel with response, not after it.
Final Thoughts for Aspiring CISOs
Incident Analysis is where security programs mature.
It requires:
Patience under pressure
Intellectual honesty
Willingness to challenge early conclusions
Discipline to document uncomfortable truths
If Incident Management is about leadership, Incident Analysis is about judgment.
Master RS.AN, and you move from reacting to incidents to truly learning from them—which is the hallmark of resilient organizations.