Which statement about CERT's stance on incidents is true?

• A. An incident must be a real adverse event.
• B. An incident does not have to be a real adverse event.
• C. CERT does not define incidents.
• D. All events are always incidents.

Answer: (B)

Think of an incident as any event that violates or could violate computer security policy. CERT’s stance is that an incident doesn’t have to be a real adverse event; a near-miss or an attempted intrusion already counts because it involves a violation or imminent threat to policy. This means you can treat suspicious activity, misconfigurations that could lead to a breach, or failed login attempts as incidents worth handling even if no damage has occurred yet. CERT does define incidents and provides guidance on how to respond to them. Saying every event is an incident would be too broad, while requiring actual harm would miss important warning signs.