What is the correct procedure for reporting an IT security incident?

What is the correct procedure for reporting an IT security incident?

• A. Use the incident report system, provide details, and do not alter or erase evidence; await guidance.
• B. Ignore the incident until a supervisor requests information.
• C. Document the event privately and email it to teammates.
• D. Delay reporting until after a full audit.

Answer: (A)

Immediate and proper handling of an IT security incident means following the official reporting process, preserving evidence, and awaiting direction from the incident response team. Using the designated incident report system ensures the event is logged, categorized, and queued for proper escalation, so responders know what happened, when, where, and how severe it is. Providing clear details—like affected systems, timestamps, observed symptoms, and any actions already taken—helps responders assess scope, containment needs, and next steps accurately. Preserving evidence by not altering or erasing anything maintains the integrity of forensic data and supports accurate investigation and any potential legal or compliance requirements. Jumping ahead or modifying data can contaminate the evidence and lead to faulty conclusions. Waiting for guidance prevents conflicting actions and ensures containment, eradication, and recovery are coordinated. Official procedures are designed to minimize damage and maintain traceability. Other approaches fall short because ignoring the incident delays protection and allows damage to continue; privately documenting and sharing with teammates lacks formal tracking and may not trigger the necessary response; delaying reporting until after a full audit leaves a window of vulnerability and can miss critical indicators or required governance steps.

Immediate and proper handling of an IT security incident means following the official reporting process, preserving evidence, and awaiting direction from the incident response team. Using the designated incident report system ensures the event is logged, categorized, and queued for proper escalation, so responders know what happened, when, where, and how severe it is. Providing clear details—like affected systems, timestamps, observed symptoms, and any actions already taken—helps responders assess scope, containment needs, and next steps accurately.

Preserving evidence by not altering or erasing anything maintains the integrity of forensic data and supports accurate investigation and any potential legal or compliance requirements. Jumping ahead or modifying data can contaminate the evidence and lead to faulty conclusions.

Waiting for guidance prevents conflicting actions and ensures containment, eradication, and recovery are coordinated. Official procedures are designed to minimize damage and maintain traceability.

Other approaches fall short because ignoring the incident delays protection and allows damage to continue; privately documenting and sharing with teammates lacks formal tracking and may not trigger the necessary response; delaying reporting until after a full audit leaves a window of vulnerability and can miss critical indicators or required governance steps.