Incident Management and Reporting
Detection, classification, and response
Incident management moves through detection, triage and classification, containment, eradication, recovery, and post-incident review. Classification uses severity criteria tied to impact (data, customers, operations, financial, regulatory). Candidates should distinguish an event (an observable occurrence) from an incident (an event that disrupts or threatens operations or compliance) and from a breach (an incident involving unauthorized access to protected data).
Escalation and notification
Notification obligations vary by regime and often have strict clocks. Questions frequently test who must be notified, when, and what must be reported. Regulators, affected individuals, law enforcement, and business partners may each have different triggers and timelines. A trap is assuming internal escalation satisfies external obligations, or that notification can wait until the full investigation is complete - many regimes require initial notice within a fixed window, with details to follow.
Evidence, documentation, and learning
Maintain an incident log with timeline, decisions, and evidence. Preserve forensic integrity. Post-incident reviews should identify root cause and control failures and feed remediation into the risk register. Regulatory reporting accuracy matters: under-reporting or late reporting can itself be a violation.
Worked example
A laptop with customer data is lost. The team confirms encryption was enabled, so the data was not accessible. Many regimes treat properly encrypted lost devices as not requiring individual notification, but the incident is still logged and assessed. Rule of thumb: classify first, then apply the notification decision tree - do not notify reflexively, but never let investigation delay a mandatory clock.