Report Security Operations and Coordinate Incident Communications

• Incident declaration depends on analyzed activity meeting defined criteria
• Incident priority reflects impact and urgency rather than arrival order
• Escalation and elevation should reach the capability or authority the incident needs
• New evidence can change an incident's priority and reporting needs
• An incident executive summary emphasizes business impact and decisions
• Incident summaries should state uncertainty without delaying useful updates
• A communication plan defines who communicates what to whom and when
• Legal counsel helps identify incident-related disclosure and preservation obligations
• Public relations coordinates authorized messaging to the media and public
• Regulatory notification follows the requirements that apply to the affected organization and incident
• Law-enforcement engagement uses designated contacts and the incident response plan
• Affected customers need actionable information rather than an internal investigation dump
• Provider participation requires a clear division of response and communication responsibilities
• Employee misconduct and physical access needs determine additional incident stakeholders
• Suspected compromise of normal communications calls for an independent channel
• Response plans and contact information need an accessible fallback
• Incident records need protection against unauthorized access and alteration
• Information-sharing labels constrain who may receive incident information
• A sharing label is not a substitute for secure transport or access control
• An after-action report records the incident and how the organization responded
• Root cause analysis identifies the underlying conditions that enabled an incident
• Lessons-learned reviews examine what worked and what needs to improve
• Documented lessons need to feed updates to plans and operational controls
• Useful incident lessons can be shared before recovery is complete
• A handover should let the incoming team continue the response without reconstructing it
• Open handover actions need explicit ownership and timing
• Handover records should preserve what was examined and why conclusions were reached
• Incoming responders need to know which temporary controls and restrictions remain active
• Internal threat intelligence should explain why the threat matters to this organization
• Intelligence reports should state confidence and important caveats
• Indicator timing matters when interpreting an internal intelligence report
• Actionable intelligence connects findings to suitable defensive responses
• Threat behavior gives internal reports context beyond a list of indicators
• Alert volume measures generated alerts rather than confirmed incident count
• Repeated benign alerts point to detection tuning rather than more incident declarations
• True-positive and false-positive percentages need explicit denominators
• Response-time metrics need defined starting and ending events
• Mean time to detect measures how long activity remains undiscovered
• Mean time to respond focuses on the delay to the defined response milestone
• Mean time to remediate tracks how long corrective work takes to resolve the weakness
• Mean time to close describes completion of the defined case workflow
• A faster average can reflect a different case mix rather than better handling
• Phishing campaign click rate measures interaction with the simulated lure
• Phishing click-rate trends need the difficulty and relevance of the lure
• False-positive rate measures how often benign cases incorrectly trigger detection
• True-positive rate measures detection across actual positive cases, including those missed

Unlock with Premium — includes all practice exams and the complete study guide.