💻 computer science

SoK: A Taxonomy for Cybersecurity Incident Response Influence Factors

This paper presents the "Cybersecurity Incident Response Influencing Factor Taxonomy" (CIR-IF Taxonomy), a comprehensive framework derived from a systematic review of 456 sources that organizes multidisciplinary factors influencing incident response and demonstrates superior rigor and coverage compared to existing scientific and NIST standards.

Original authors: Thomas Biege, Marius Brockhoff, Jonas Kaspereit, Fabian Ising, Lea Gröber, Sebastian Schinzel

Published 2026-07-03

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Thomas Biege, Marius Brockhoff, Jonas Kaspereit, Fabian Ising, Lea Gröber, Sebastian Schinzel

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine cybersecurity incident response as a high-stakes emergency room for a hospital. When a cyberattack hits, it's like a massive influx of patients arriving at once. The "doctors" (security analysts) need to diagnose the problem, stop the bleeding, and heal the patient before the hospital collapses.

For decades, researchers and experts have been writing books and papers about how to run this emergency room better. But until now, these books were scattered across different shelves: some talked about the medical equipment (technology), others about the doctors' training (human skills), and others about the hospital's budget and rules (organization). There was no single map to show how all these pieces fit together.

This paper, titled "SoK: A Taxonomy for Cybersecurity Incident Response Influence Factors," is the team's attempt to build that master map.

The Mission: Organizing the Chaos

The authors (a team of researchers from Germany and the US) asked a simple question: "What actually makes a security team good or bad at handling an attack?"

They didn't just guess. They went on a massive scavenger hunt through academic literature, looking at 457 different documents (like searching through thousands of medical journals). After a rigorous filtering process—checking for quality, relevance, and scientific rigor—they narrowed it down to 105 high-quality studies.

From these 105 studies, they built the CIR-IF Taxonomy. Think of this taxonomy as a giant, organized filing cabinet or a "Periodic Table" for cybersecurity response. Instead of elements like Hydrogen or Oxygen, it lists the specific "ingredients" that influence how well a team responds to a hack.

The Two Main Shelves: People vs. The Environment

The authors realized that everything influencing a security team falls into two main buckets:

1. The Human Factors (The Doctors)
This is about the people doing the work. The paper found that the most important things here are:

Knowledge & Skills: Do the analysts know their stuff? Do they have the right "soft skills" (like staying calm) and "hard skills" (like coding)?
Situational Awareness: Can they see what's happening in real-time? It's like a pilot needing to see the clouds, the fuel gauge, and the other planes all at once.
Collaboration: Do they talk to each other? If the team doesn't share information, they are like a group of doctors shouting different diagnoses in the same room.
Mental State: Are they stressed? Do they trust their boss? The paper highlights that burnout is a huge factor. If analysts are exhausted or don't feel trusted, they make mistakes.

2. The Context Factors (The Hospital Environment)
This is the world the doctors work in. Even the best doctor will fail if the hospital is broken. Key factors here include:

Management & Leadership: Does the boss give them the tools and authority they need? Or do they have to ask for permission for everything?
Money & Budget: Can they afford the best tools? Or are they trying to fight a fire with a water pistol because the budget was cut?
Technology: Are the tools easy to use, or are they clunky and confusing?
Rules & Laws: What are the legal requirements they have to follow?
The Attacker: Who are they fighting? How smart and motivated is the enemy?

The Big Discovery: The Map vs. The Official Guidebook

The team compared their new "Master Map" (the Taxonomy) against the industry's most famous guidebook, the NIST Cybersecurity Framework (specifically version 800-61r3).

Here is the surprising finding: The official guidebook is missing a lot of the human stuff.

The Guidebook (NIST) focuses heavily on technology, processes, and rules. It's like a manual that tells you exactly how to use the defibrillator and how to fill out the paperwork.
The New Map (Taxonomy) shows that the real success of a team often depends on things the guidebook barely mentions: trust, leadership style, employee burnout, and how well the team communicates.

The authors argue that you can have the best tools in the world, but if your team is stressed, untrusted, and overworked, the tools won't save you.

How This Helps (According to the Paper)

The paper doesn't claim to have "cured" cyberattacks or built a new software tool. Instead, it offers a tool for thinking:

For Researchers: It gives them a checklist. If they want to study why a team failed, they can use this map to see if they missed a factor (like "stress" or "budget") that others have already identified.
For Practitioners: It helps them understand that fixing a security problem isn't just about buying better software. Sometimes, the solution is better management, more training, or fixing the team's culture.
Connecting the Dots: The authors created a "chain reaction" example. They showed how a bad management decision (like cutting the budget) can lead to a lack of tools, which leads to unskilled staff, which leads to stress, which leads to burnout. This helps people see how one small problem can cause a big disaster.

The Bottom Line

This paper is a systematic cleanup crew. It took decades of scattered research, sorted it into a logical, easy-to-read structure, and pointed out that the industry has been focusing too much on the machines and not enough on the people and the environment in which they work.

It's not a magic wand that stops hackers, but it is a much better flashlight for anyone trying to understand how to build a team that can survive the storm.

Technical Summary: SoK: A Taxonomy for Cybersecurity Incident Response Influence Factors

Problem Statement

The literature on cybersecurity incident response (CIR) has expanded significantly since the early 2000s, driven by increasing cyberattack frequency and complexity. However, this body of knowledge remains fragmented across multiple domains, including technology, human-computer interaction, organizational theory, and human factors. Existing industry standards (e.g., NIST SP 800-61) and academic frameworks often lack a unified, bottom-up systematization of the specific factors that influence an organization's preparedness and response capabilities. There is a critical gap in a comprehensive, science-domain-agnostic taxonomy that consolidates decades of empirical findings to guide future research and practice.

Methodology

The authors conducted a three-phase systematic literature review (SLR) following PRISMA 2020 guidelines, analyzing a total of 457 publications (417 scientific, 40 non-scientific) published between 1999 and mid-2024.

Selection Process:
- Phase I (Search): A systematic search across Google Scholar, JSTOR, and SCOPUS using core concepts ("incident response," "influence," "cybersecurity") yielded 457 articles.
- Phase II (Screening): 190 articles were selected based on alignment with the NIST definition of incident response, excluding studies focused solely on detection/recovery, military/intelligence operations, or kinetic incidents.
- Phase III (Quality Assessment): 105 peer-reviewed articles (conferences, journals, doctoral theses) meeting strict quality criteria (clear research design, focus on organizational/human challenges rather than just technical innovation) formed the final dataset.
Taxonomy Development:
- The authors adapted the taxonomy development method proposed by Nickerson et al. [11], extending it to handle qualitative, non-discrete factors.
- Step 1 (Codebook): A preliminary taxonomy was derived from 12 top-tier papers using a mixed deductive-inductive coding approach. Iterative sampling and refinement continued until conceptual saturation was reached.
- Step 2 (Validation): The preliminary taxonomy was applied to the remaining 93 papers. Inter-rater reliability (IRR) was measured using Cohen's kappa. Through three iterations of refining category names, descriptions, and merging overlapping subcategories (e.g., combining "People Management," "HR," and "Daily Work" into "Management"), the team achieved a final IRR of $\kappa = 0.721$ , exceeding the 0.61 threshold.
- Comparison: The resulting taxonomy was compared against seven established academic frameworks and the NIST SP 800-61r3 Community Profile to identify coverage gaps.

Key Contributions

The primary contribution is the Cybersecurity Incident Response Influencing Factor (CIR-IF) Taxonomy, a structured framework organizing 105 influencing factors into two main dimensions: Human Factors and Context Factors.

Human Factors Dimension: Focuses on the individuals involved in response.
- Knowledge: Employees' hard/soft skills and cybersecurity situational awareness.
- Cognition, Personality Traits, and Behavior (CPTB): Intrinsic motivation, confidence, stress handling, sensemaking, decision-making, and collaboration.
Context Factors Dimension: Focuses on the environment in which response occurs.
- Attacker: Motivation, objectives, capabilities, and Tactics, Techniques, and Procedures (TTPs).
- Regulations: Laws, official regulations, industry norms, and standards.
- Economic: Budget, revenue pressures, business impact, and industry partners/supply chain.
- Technology: Tooling, usability, data quality, IT infrastructure, and automation.
- Processes: Standard Operating Procedures (SOPs), playbooks, and policies.
- Organization: Structure, size, hierarchy, management practices, organizational learning, and company culture.

Additionally, the paper provides a codebook with textual examples for each factor, enabling other researchers to apply this taxonomy in qualitative content analysis (e.g., Mayring method) and offering a method for deriving potential relationships between factors.

Results

Publication Trends: The number of relevant publications saw a significant increase starting in 2014, continuing to rise through 2022.
Factor Distribution:
- Top Human Factors: Employees' Knowledge/Skills (32%), Cybersecurity Situational Awareness (23%), and Collaboration (19%).
- Top Context Factors: Management (19%), Tooling/Usability/Data/IT Infrastructure (16%), and SOPs/Playbooks/Policies (16%).
Gap Analysis:
- Compared to NIST SP 800-61r3, the CIR-IF Taxonomy reveals that the standard heavily focuses on context-related factors (technology, processes) but underrepresents human factors (cognitive abilities, stress, motivation) and specific organizational dynamics (management styles, culture).
- Existing academic frameworks cover only subsets of the categories identified in the CIR-IF Taxonomy, confirming the need for a more comprehensive model.
Dependency Chains: The authors constructed theoretical dependency chains linking factors across studies (e.g., Management $\to$ Budget $\to$ Analyst Skills $\to$ Burnout $\to$ Stress Handling). These chains align with the Job Demands–Resources (JD-R) model but are presented as hypotheses for future verification, not proven causality.

Significance and Claims

The paper positions the CIR-IF Taxonomy as the first unified, bottom-up systematization of CIR influencing factors derived from empirical data. Its significance lies in:

Providing a Foundation: Offering researchers a "low-friction entry point" and a solid foundation for hypothesis generation and theory building in a field previously lacking a unified structure.
Bridging Gaps: Highlighting that current industry standards (NIST) and academic models often overlook critical human and organizational dimensions, such as the impact of management styles on analyst burnout or the role of trust in conflict resolution.
Enabling Systematic Research: The provided codebook and taxonomy allow for the systematic classification of new findings, facilitating the identification of underexplored areas (e.g., the specific influence of industry partners like insurers on decision-making).
Modest Scope: The authors explicitly state that the identified factor relationships are theoretical constructs based on existing literature and do not represent empirically verified causality. The taxonomy reflects the current state of academic research and is designed to be extensible as the field evolves.