After a significant security incident, the incident response team must formally notify senior leadership and potentially regulators. Which reporting element is most critical to include in the initial incident declaration?

Question

Accepted Answer

A. A clear description of the incident, scope of impact, affected systems, and immediate actions taken. The initial incident declaration must include enough information for leadership and regulators to understand what happened, the scope of impact, which systems are affected, and what immediate containment actions have been taken. The CySA+ Reporting and Communication domain covers incident declaration, escalation, and reporting requirements. Full RCA and forensics come later in the process.

After a significant security incident, the incident response team must formally notify senior leadership and potentially regulators. Which reporting element is most critical to include in the initial incident declaration?

Related Questions

Discussion