How is a security incident defined?

• A. A report of potential security threats yet to be confirmed
• B. A confirmed breach of security leading to unauthorized access, disclosure or destruction of information
• C. A routine examination of a security system
• D. An organization’s overview of its security policies

Answer: (B)

A security incident is defined as a confirmed breach of security that results in unauthorized access, disclosure, or destruction of information. This definition emphasizes the necessity of verification—an incident is not merely a potential threat or a speculation about a vulnerability; it is an event that has demonstrably caused harm or compromise to an organization's information systems or data.

The focus on "confirmed" highlights that incidents are based on objective evidence or analysis, which is critical for establishing the severity and implications of the event. When an incident leads to unauthorized access, it indicates that security measures have failed to protect sensitive information, and that mitigations will be necessary to address the breach and prevent future occurrences.

In contrast, the other options do not describe a security incident accurately. Potential threats that have yet to be confirmed do not constitute an incident because they lack the evidence of impact. Routine examinations pertain to proactive security practices, not reactive responses to incidents. An overview of security policies relates to governance and compliance rather than a specific event of security compromise. Understanding this definition of a security incident is vital for effectively responding to threats and managing an organization's overall cybersecurity strategy.