Requiring technicians to report spyware infections is a step in which of the following?

Routine audits are scheduled reviews of systems and controls to assess compliance and security posture, not a process for reporting active security incidents.

Change management governs the controlled process of making modifications to IT systems and configurations, unrelated to responding to active malware infections.

Incident management establishes the formal processes for identifying, reporting, and handling security incidents such as malware infections. Mandating that technicians report spyware detections is a detection and escalation step within the incident response lifecycle, ensuring infections are tracked, contained, and remediated in a systematic way.

A clean desk policy is a physical security control requiring employees to secure sensitive materials when not in use, with no relation to malware reporting.