Triage is the rapid initial assessment and prioritization of security events. The goal is to filter the stream of alerts and identify those requiring immediate response. Typical criteria include severity, affected systems, and potential business impact. In an ISMS, triage is a core step in the incident response process. A clearly defined triage procedure prevents critical incidents from getting lost in the noise and ensures that response resources are allocated where they matter most.