You are the first to arrive at work in the morning and notice that the CD ROM on which you saved contracts yesterday has disappeared. You were the last to leave yesterday. When should you report…

Question

Options

• AThis incident should be reported immediately.
• BYou should first investigate this incident yourself and try to limit the damage.
• CYou should wait a few days before reporting this incident. The CD ROM can still reappear and, in that case,

• A
  70% (30)
• B
  9% (4)
• C
  21% (9)

Explanation

Immediate reporting is correct because security incidents involving sensitive data (contracts) must be escalated to your organization's security team right away - every minute of delay increases the risk of data breach, regulatory violation, or evidence loss that only trained responders can properly manage.

Why B is wrong: Self-investigation is dangerous; you may contaminate evidence, exceed your authority, or miss the actual threat vector. Incident response is a team function with defined procedures.

Why C is wrong: Waiting "a few days" is never acceptable in information security - the assumption that it might reappear is wishful thinking that ignores real threats like theft or unauthorized copying. Timely reporting is a core tenet of every security framework (ISO 27001, GDPR, etc.).

Memory tip: Think of it like a fire alarm - you don't investigate the smoke yourself or wait to see if it clears up on its own. You pull the alarm immediately and let the professionals handle it.

No community discussion yet for this question.