# Triage

The **Triage** phase is the first and crucial step in the TRACeR method for incident management. It involves the **initial assessment** of incoming incidents to determine their **priority, categorisation, and urgency**. The objective is to ensure that incidents are handled efficiently, based on their impact and severity, and that resources are allocated appropriately to minimise disruption.

## **Key Actions in the Triage Phase**

1. **Incident Logging**:
   * Gather essential details about the incident, such as the type of issue, affected systems, users involved, and relevant timelines.
   * Ensure the incident is documented accurately for tracking and follow-up.
2. **Prioritisation**:
   * Assess the incident's impact (potential damage or consequences) and urgency (how quickly it needs to be resolved).
   * Assign a priority level (e.g., critical, high, medium, low) to determine the appropriate response time and attention required.
3. **Categorisation**:
   * Classify the incident based on its nature—hardware, software, security, or network issues. Proper categorisation helps route the incident to the correct team for resolution.
4. **Initial Assignment**:
   * Allocate the incident to a responder or team capable of managing the identified issue. This may involve assigning it to a first-level support group or determining if escalation is needed.

## **Outcomes of the Triage Phase**

* **Effective Incident Handling**: By establishing the correct **priority** and **category**, incidents can be processed efficiently and organised, ensuring that critical issues receive the attention they need first.
* **Resource Optimisation**: Triage helps optimise the use of **available resources**, directing them to the most pressing incidents and reducing unnecessary downtime.
* **Reduced Escalation Delays**: Proper triage reduces escalation delays by identifying the correct support level early on, ensuring incidents are routed promptly to the right team.

The Triage phase is essential for setting a structured and efficient tone for the rest of the incident management process. It ensures that incidents are appropriately logged, prioritised, and assigned, allowing for streamlined handling and better response outcomes.