When should authorities be notified in a security incident?

When should authorities be notified in a security incident?

• A. Only if owner asks
• B. After one week
• C. If necessary, as part of the process
• D. Never

Answer: (C)

Notifying authorities is done when it’s necessary as part of the incident response process. The decision to involve law enforcement, regulators, or other authorities depends on the incident’s severity, scope, potential harm to people or operations, and any legal or regulatory requirements. The idea is to act promptly to protect stakeholders, preserve evidence, and comply with applicable laws, while coordinating with relevant authorities as needed. This means you don’t notify automatically in every case, but you escalate when the risk or obligations justify it.

Saying it should be done only if the owner asks is not correct, since reporting is often guided by policy and law rather than a single stakeholder’s request. Waiting a week before any action is inappropriate in many scenarios and can worsen outcomes or violate obligations. And never notifying authorities ignores required responsibilities in cases with significant impact or legal triggers.