Incident handling workflow, where would the standard fit in?
Incident handling workflow: CSIRT interaction
Incident handling workflow: CSIRT Internal