Which statement describes a robust incident response procedure?

Which statement describes a robust incident response procedure?

• A. Limit information sharing and keep it within management.
• B. Cease all operations and wait for instructions.
• C. Report promptly, document facts, preserve evidence, and follow a defined incident response plan.
• D. Publicly announce the incident immediately.

Answer: (C)

Robust incident response relies on acting quickly and in an orderly, organized way. The practice of reporting promptly, documenting facts, preserving evidence, and following a defined incident response plan embodies that approach. Prompt reporting gets the right people involved while the incident is fresh, enabling faster containment and decision-making. Documenting facts creates a clear, traceable timeline of what happened, who observed it, and what actions were taken, which supports accurate analysis and accountability. Preserving evidence with proper handling maintains forensic integrity, so investigators can determine root cause and prevent recurrence. Following a defined plan ensures coordinated efforts across teams, preventing chaos and ensuring steps like identification, containment, eradication, recovery, and lessons learned are carried out consistently. Limiting information sharing, stopping operations without guidance, or making a public announcement too soon tend to hinder containment, increase harm, or leak sensitive details, which is why the described approach is the strongest choice.

Robust incident response relies on acting quickly and in an orderly, organized way. The practice of reporting promptly, documenting facts, preserving evidence, and following a defined incident response plan embodies that approach. Prompt reporting gets the right people involved while the incident is fresh, enabling faster containment and decision-making. Documenting facts creates a clear, traceable timeline of what happened, who observed it, and what actions were taken, which supports accurate analysis and accountability. Preserving evidence with proper handling maintains forensic integrity, so investigators can determine root cause and prevent recurrence. Following a defined plan ensures coordinated efforts across teams, preventing chaos and ensuring steps like identification, containment, eradication, recovery, and lessons learned are carried out consistently. Limiting information sharing, stopping operations without guidance, or making a public announcement too soon tend to hinder containment, increase harm, or leak sensitive details, which is why the described approach is the strongest choice.