How do we run a weekly triage that doesn't turn into a two-hour argument?

Start

The weekly triage keeps turning into a long argument

Long triage meetings usually come from doing the analysis in the room: arguing each finding's priority from scratch, discovering who owns a system, and walking through hundreds of scanner lines. The routine the pack describes is 30 minutes a week. The preparation before it and the follow-up after it are what make 30 minutes enough.

• Then: Prepare the day before, outside the meeting

Step

Prepare the day before, outside the meeting

The triage lead checks that last week's scans ran, exports new findings, and proposes a priority and an owner for each using the rating model and the asset inventory. A finding already open keeps its original detection date. The pack allows 60 to 90 minutes a week for this once the routine is established, finished by the end of the working day before.

• Then: Group findings by the fix, one ticket per owner

Step

Group findings by the fix, one ticket per owner

Hundreds of new findings a week usually come from one or two missing updates across many systems. Group findings that one action will fix into one ticket per owner, and keep each finding's own deadline. Thirty-two servers missing the same update become one line on the agenda.

• Then: Keep Priority 4 findings off the agenda

Step

Keep Priority 4 findings off the agenda

Priority 4 findings are not discussed one by one. They go in bulk to the owner's normal patch cycle and appear on the agenda only when they are within 7 days of their deadline. In the pack's worked example this is why dozens of low-priority findings took no meeting time.

• Then: Handle Priority 1 and 2 before the meeting

Step

Handle Priority 1 and 2 before the meeting

A Priority 1 finding never waits for the meeting; it goes straight to the emergency route. Priority 2 findings get an owner and a ticket within 2 working days of detection. The meeting then only confirms what was done. This also protects the deadlines: a finding found the day after a meeting has already used up to a week by the next one.

• Then: Send a timed agenda to the owners of each item

Step

Send a timed agenda to the owners of each item

The pack's slots: 5 minutes on Priority 1 and last week's actions, 10 on new Priority 1 to 3 findings, 10 on findings due within 7 days or overdue, and 5 on verifications, false positives, coverage and expiring exceptions. Invite the asset owners with an item on the agenda, and service providers or their written update. Hold the meeting even when attendance is thin; a short meeting with a record beats a cancelled one.

• Then: Is anyone disputing this item?

Decision

Is anyone disputing this item?

Owners who dispute a priority or ownership say so in the meeting, when the item comes up. These are the two disputes the procedure expects the meeting to settle. Treat each by its own rule, and do not let either become a debate about the whole method.

• Priority: Re-read the priority from the model's inputs
• Ownership: Take the owner from the asset inventory
• No dispute: Does the item need more than two minutes?

Step

Re-read the priority from the model's inputs

The rating model is applied, not debated. Check the inputs: exploitation, exposure, severity and criticality. If an input is wrong, correct it and read the priority again. Anyone may propose raising a priority. Only the standard owner may lower one, with a recorded reason, and never to avoid a missed deadline.

• Then: Can the standard owner settle it in the room?

Step

Take the owner from the asset inventory

The owner is whoever the asset inventory names. If none is recorded, or the named owner disputes it, the standard owner assigns one. Every Priority 1 to 3 finding leaves the meeting with a named owner. Correct the inventory the same week so the same dispute does not come back; ownership disputes are the most common reason findings go unfixed.

• Then: Can the standard owner settle it in the room?

Decision

Can the standard owner settle it in the room?

The standard owner attends when a priority, false positive or ownership needs deciding, and decides on the spot where the facts are clear. If the facts are missing, the room cannot supply them by arguing.

• Yes: Does the item need more than two minutes?
• No, or not known: Standard owner decides within 2 working days

Step

Standard owner decides within 2 working days

An ownership or priority dispute not settled in the meeting goes to the standard owner, who decides within a set time. The pack's default is 2 working days. The deadline keeps running from first detection meanwhile, so the finding still needs someone working on it.

• Then: Does the item need more than two minutes?

Decision

Does the item need more than two minutes?

The meeting is not a technical working session. Any item that needs more than two minutes of discussion is a sign the detail belongs elsewhere.

• Yes: Give it an owner and a date, and take it offline
• No: Is it due within 7 days, or already overdue?

Step

Give it an owner and a date, and take it offline

Agree who will work it out and by when, and move on. The agreed action for each new finding is one of three: fix, apply a compensating control and fix, or request an exception.

• Then: Is it due within 7 days, or already overdue?

Decision

Is it due within 7 days, or already overdue?

Findings close to their deadline, and those past it, are the ones that need a decision this week. Everything else only needs confirming.

• Yes: Ask for a date; escalation follows the calendar
• No: Are there items left on the agenda?

Step

Ask for a date; escalation follows the calendar

Ask the owner for a fix date. Escalation dates follow from the deadline and are not negotiated in the meeting, which removes a whole class of argument. If the deadline cannot be met, agree who will request an exception, and by when; it must be before the deadline passes.

• Then: Are there items left on the agenda?

Decision

Are there items left on the agenda?

Work through the agenda in its time slots, item by item. Each item leaves with a decision, an owner, or a date for one.

• Yes: next item: Is anyone disputing this item? (back to an earlier step)
• No: Read back actions, then record and raise tickets

Step

Read back actions, then record and raise tickets

Close by reading back the action list. Within 1 working day, raise or update each agreed ticket with asset, priority, owner, detection date and deadline. Send the escalations decided, and record the meeting: attendees, decisions, escalations and actions. The record is the evidence an auditor asks for.

• Then: Did the meeting fit in about 30 minutes?

Decision

Did the meeting fit in about 30 minutes?

In the pack's worked example, a week with an emergency, a false positive and an overdue finding took 26 minutes and produced six decisions and four actions. If yours regularly overruns, look first at the preparation, which is what makes 30 minutes enough.

• Yes: A short meeting with a written record, every week
• No: Fix what reached the agenda, not the meeting

Step

Fix what reached the agenda, not the meeting

Look at what took the time. Ungrouped findings, Priority 4 lines, unresolved owners in the inventory and debates about the model all point back to preparation. Findings escalated often usually point to a capacity problem, which the pack says belongs in the monthly report, not in the triage room.

• Then: Prepare the day before, outside the meeting (back to an earlier step)

Outcome

A short meeting with a written record, every week

Every new Priority 1 to 3 finding has a confirmed priority, a named owner and an agreed action. Late findings are escalated on their dates. The meeting record shows the routine ran and what was decided.