Identification refers to the first step in the incident response process where an organization determines whether they have been breached or not. Security professionals will seek indicators of compromise while in this step of incident response. They will attempt to find damage that’s been done to computer systems or a network, or evidence that data has been copied and removed from its secure locations within an environment or business system. Not every security breach yielded damage to networks or computers, they often amount to the theft of intellectual property or critical data such as financial records, health records or other Non-Public Personal Information (NPPI).
The ultimate purpose of Identification is to determine if an incident has occurred and whether to invoke an Incident Handling process or stand down the resources that are being marshalled to fight a potential breach.