Which of the following should have the GREATEST influence on incident categorization?

Question

Options

• AAudit requirements
• BIndividual or department reporting the incident
• CValue of information
• DHistory of similar incidents

• A
  8% (3)
• B
  16% (6)
• C
  73% (27)
• D
  3% (1)

Explanation

Value of information drives incident categorization because the severity and priority of any incident should reflect the criticality of the asset or data affected - a breach involving highly sensitive financial or personal data warrants a higher category than one affecting low-value systems, regardless of who reported it.

Why the distractors fall short:

• A (Audit requirements): Audits document and review incidents after the fact; they don't determine how an incident should be classified in real time.
• B (Individual or department reporting): Categorization must be objective. Letting the reporter's identity influence priority introduces bias and inconsistency.
• D (History of similar incidents): Past incidents inform response procedures and trend analysis, but a recurring low-value incident doesn't automatically escalate in category, nor does a novel high-value one get downgraded.

Memory tip: Think "What's at stake?" - incident categorization is fundamentally a risk-based decision, and risk is always anchored to the value (and sensitivity) of what's being protected. High-value asset = high-category incident.

No community discussion yet for this question.