Decision tools allow you to ensure that you have repeatable, methodical, and trustworthy processes as it relates to your incident response capability. These tools allow you to take the triaged threat information from your observation and orientation tools and make an appropriate risk-based decision to protect your organization.

Unlike the other tools we have discussed so far, decision tools are not something you can simply download and start running against your information system. Decision tools are the policies, procedures, and plans that you put together as part of your information security and incident response programs. While there are great places on the internet to grab samples, you will quickly find that they do not address the needs of your organization. This is because you must build policy, procedures, and plans that fit into your organization's unique organizational culture, and tie into your business and mission needs and purpose. No template on the internet can do that for you. As you develop your tools that support your incident response decision-making process you must ensure that you tightly adhere to the following:

• Your organization's corporate policy
• Your organization's regulatory requirements
• Your organization's applicable laws