{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,19]],"date-time":"2026-03-19T14:46:43Z","timestamp":1773931603552,"version":"3.50.1"},"reference-count":45,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"6","license":[{"start":{"date-parts":[[2022,12,1]],"date-time":"2022-12-01T00:00:00Z","timestamp":1669852800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2022,12,1]],"date-time":"2022-12-01T00:00:00Z","timestamp":1669852800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2022,12,1]],"date-time":"2022-12-01T00:00:00Z","timestamp":1669852800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Eng. Manage."],"published-print":{"date-parts":[[2022,12]]},"DOI":"10.1109\/tem.2020.2979832","type":"journal-article","created":{"date-parts":[[2020,5,5]],"date-time":"2020-05-05T20:23:06Z","timestamp":1588710186000},"page":"3771-3791","source":"Crossref","is-referenced-by-count":34,"title":["SOTER: A Playbook for Cybersecurity Incident Management"],"prefix":"10.1109","volume":"69","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-0174-8232","authenticated-orcid":false,"given":"Cyril","family":"Onwubiko","sequence":"first","affiliation":[{"name":"Artificial Intelligence, Blockchain & Cyber Security, Research Series Limited, Essex, U.K."}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7129-5809","authenticated-orcid":false,"given":"Karim","family":"Ouazzane","sequence":"additional","affiliation":[{"name":"School of Computing and Digital Media, London Metropolitan University, London, U.K."}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref39","article-title":"Information Technology–Security Techniques–Information security incident management–Part 1: Principles of incident management","year":"2016"},{"key":"ref38","article-title":"Technical Risk Assessment Part 1: Risk Assessment","year":"2009"},{"key":"ref33","article-title":"Cyber harm: Concepts, taxonomy and measurements","author":"agrafiotis","year":"2016"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1093\/cybsec\/tyy006"},{"key":"ref31","article-title":"Difference between severity and priority in testing","year":"0"},{"key":"ref30","article-title":"PSN code template for: Code of interconnection","year":"2010"},{"key":"ref37","article-title":"Equivalence relation","year":"2019"},{"key":"ref36","article-title":"Security and privacy controls for federal information systems and organisations","year":"2013"},{"key":"ref35","article-title":"Data Breach","year":"2019"},{"key":"ref34","article-title":"Comparing data security terms: Data breach vs. compromise vs. leak vs. security incident","year":"0"},{"key":"ref10","first-page":"1","article-title":"Security operations centre: Situation awareness, threat intelligence and cybercrime","author":"onwubiko","year":"2017","journal-title":"Proc Int Conf Cyber Situational Awareness Data Analytics Assessment"},{"key":"ref40","article-title":"US-CERT incident reporting system","year":"2017"},{"key":"ref11","article-title":"Incident management","year":"2018"},{"key":"ref12","article-title":"Reference document on incident notification for operators of essential services","year":"2018"},{"key":"ref13","article-title":"Annex for presidential policy directive – united states cyber incident coordination","year":"2016"},{"key":"ref14","article-title":"Cyber exercise playbook","author":"kick","year":"2014"},{"key":"ref15","article-title":"Threat-based defense–A new cyber defense playbook","year":"2012"},{"key":"ref16","article-title":"MITRE ATT&CK","year":"2018"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2015.09.009"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2018.09.002"},{"key":"ref19","article-title":"Equivalence Relation","year":"2019"},{"key":"ref28","article-title":"Part 1: Concepts and Models for Information and Communications Technology Security Management","year":"2004"},{"key":"ref4","article-title":"Anatomy of a security operations center","author":"wang","year":"0"},{"key":"ref27","article-title":"Security risk management glossary","year":"2018"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.22619\/IJCSA.2016.100101"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/CyberSA.2018.8551486"},{"key":"ref29","article-title":"Special publication 800-30 revision 1L guide for conducting risk assessments","year":"2018"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.6028\/NIST.SP.800-184"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.6028\/NIST.SP.800-61r2"},{"key":"ref7","article-title":"National cyber incident response plan","year":"2016"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1016\/j.ijdrr.2016.01.004"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.22619\/IJCSA.2018.100118"},{"key":"ref1","article-title":"Cyber incident reporting: a unified message for reporting to the federal government","year":"2016"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.6028\/NIST.CSWP.04162018"},{"key":"ref45","article-title":"Forum of incident response and security teams","year":"2019"},{"key":"ref22","article-title":"Technical risk assessment part 1: Risk assessment","year":"2009"},{"key":"ref21","first-page":"1","article-title":"Cyber security operations centre: Security monitoring for protecting business and supporting cyber defense strategy, published in 2015 international conference on cyber situational awareness","author":"onwubiko","year":"0","journal-title":"Proc Int Conf Situational Awareness Data Analyt Assessment"},{"key":"ref42","article-title":"NCSC GovCERTUK incident response classification scheme","year":"0"},{"key":"ref24","article-title":"US-CERT incident reporting system","year":"2017"},{"key":"ref41","article-title":"Guide to risk assessment and response","author":"stebbins-wheelock","year":"2018"},{"key":"ref23","article-title":"Information technology–Security techniques–Information security incident management–Part 1: Principles of incident management","year":"2016"},{"key":"ref44","article-title":"HMG security policy framework","year":"2013"},{"key":"ref26","article-title":"Federal incident notification guidelines","year":"2017"},{"key":"ref43","article-title":"Time to know is the most critical factor to accelerate MTTR","author":"priddy","year":"2016"},{"key":"ref25","article-title":"Guide to risk assessment and response","author":"stebbins-wheelock","year":"2018"}],"container-title":["IEEE Transactions on Engineering Management"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/17\/9993768\/09086465.pdf?arnumber=9086465","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,12,22]],"date-time":"2022-12-22T17:02:31Z","timestamp":1671728551000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9086465\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,12]]},"references-count":45,"journal-issue":{"issue":"6"},"URL":"https:\/\/doi.org\/10.1109\/tem.2020.2979832","relation":{},"ISSN":["0018-9391","1558-0040"],"issn-type":[{"value":"0018-9391","type":"print"},{"value":"1558-0040","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,12]]}}}