Incident Reporting and Emergency Response
This domain tests whether you recognize a security incident, report it through the right channel fast, and preserve evidence instead of quietly fixing things. Most items ask for the first action.
What counts as reportable
Lost or stolen devices, a clicked phishing link, entered credentials, malware alerts, unauthorized access, data sent to the wrong recipient, suspected data breach, missing paper records, suspicious visitors, and near misses that could have caused harm. An event is an observable occurrence; an incident is an event with actual or potential negative impact.
Reporting rules
- Report immediately through the defined channel, not to a colleague for a second opinion.
- Do not investigate alone, delete files, reboot, or run cleanup tools before being told.
- Preserve evidence: screenshots, message headers, exact times, what you clicked.
- Do not discuss the incident on social media or external chat groups.
- Expect a no-blame process; concealment is the serious offense, not the mistake.
Response stages and your place in them
Preparation, detection and analysis, containment, eradication, recovery, lessons learned. Your role is detection and reporting; containment decisions belong to the incident response team, who may order disconnection, password resets or session revocation.
Emergency response
Life safety comes first: evacuate, go to the assembly point, do not re-enter, and follow wardens. Report cyber incidents that affect safety systems to emergency responders as well as IT.
Worked example
A user enters corporate credentials on a page reached from an email link and realizes the page looked wrong. The correct sequence: report immediately, reset the password, revoke active sessions, check for new mailbox forwarding rules or payment changes, and keep the original email. Reasoning: dwell time is what turns a single credential leak into a breach; deleting the email destroys the indicators the team needs.
Marks that are easy to lose
- Waiting to see whether anything happens.
- Forwarding a suspicious email to IT and then deleting it.
- Confronting an intruder instead of reporting and withdrawing.
- Assuming reporting gets you punished, which suppresses the fastest source of detection.