When reporting a security incident, which option is correct?

When reporting a security incident, which option is correct?

• A. Inform only the shift supervisor after the incident is resolved.
• B. Document and share details with the public.
• C. Notify the incident command and follow the chain of command.
• D. Wait for another department to take over.

Answer: (C)

Effective incident reporting relies on notifying the incident command and following the chain of command. This ensures a coordinated response, timely escalation of actions, clear accountability, and proper documentation for after‑action reviews. Informing only the shift supervisor after the incident is resolved delays critical information and prevents a unified response. Sharing details with the public can expose sensitive information and undermine security. Waiting for another department to take over creates gaps in responsibility and disrupts the orderly handoff the command structure is designed to manage.

Effective incident reporting relies on notifying the incident command and following the chain of command. This ensures a coordinated response, timely escalation of actions, clear accountability, and proper documentation for after‑action reviews.

Informing only the shift supervisor after the incident is resolved delays critical information and prevents a unified response. Sharing details with the public can expose sensitive information and undermine security. Waiting for another department to take over creates gaps in responsibility and disrupts the orderly handoff the command structure is designed to manage.