Victim ID

Question Text: Victim organization ID:

User notes: N/A

Question type: text field

Variable name: victim.victim_id (string)

Purpose: To associate incidents with the entity that was affected by them (without identifying the entity itself). Even in anonymous incident sharing scenarios, this can be useful for many purposes. For instance, it is necessary to study things like the average number of incidents per organization, why certain organizations suffer more incidents, whether certain corrective actions lead to reduced incidents/losses, etc.

Developer notes: If you plan to share incident with others, we suggest not making your org's name part of the victim ID. In certain situations (incident tracking within a single organization), this field may be auto-populated rather than prompting the user.

Miscellaneous:

• Many VERIS users won't need this field at all - either because they're using it internally or because they're using it anonymously. Assuming you do want to record and share the victim name (i.e., if you're contributing to VCDB), the most important thing is to record a “proper” and recognizable form of the name to aid analysis.
• If the victim's name is not known, leave victim_id blank. If you record something like “Unknown retailer,” it makes it difficult to distinguish that from a real name during analysis.
• Always use the full/official name of the victim rather than abbreviations or shortened versions. For orgs like “IBM,” where the acronym is the official name, use that. This will help maintain consistent records (i.e., it's hard for a database to know that “BOA” and “Bank of America” are the same entity).
• If the victim is a national government agency, always use the two-digit ISO country country code with no periods (e.g, “US Department of the Treasury” instead of “U.S.” or “United States.” Beyond that, try to use the full official name (e.g., “US Department of the Treasury” rather than “US Treasury Department” or “U.S. Dept of Treasury.”
• If the victim is a state or local government agency, always use the “City of…” or “State of…” format. So New York Fire Department would be “City of New York Fire Department.”