How do you distinguish a security incident from a data breach?

• A. A security incident is a malware infection.
• B. A data breach is unrelated to data exposure.
• C. A security incident is unrelated to data exposure.
• D. A security incident is any event affecting confidentiality, integrity, or availability; data breach is unauthorized exposure of data.

Answer: (D)

Understanding the distinction starts with recognizing what each term covers. A security incident is any event that affects the confidentiality, integrity, or availability of information or information systems. That means it can range from a malware infection to a failed login, or a service outage—anything that disrupts normal security expectations. A data breach is specifically about data being exposed or accessed by unauthorized parties, i.e., an unauthorized disclosure of data.

With that in mind, the best answer defines both terms clearly: a security incident encompasses events impacting the CIA triad, while a data breach is an unauthorized exposure of data. This explains why a malware infection is a type of incident rather than the definition itself, and why a breach is about data exposure. The other options contradict the established definitions: they either describe unrelated concepts or claim that incidents are not connected to data exposure.

In short, not every security incident involves data exposure, but a data breach is always about unauthorized exposure of data. This distinction guides how we respond and communicate the impact.