To whom should you report a data security incident according to typical policies?

• A. HR.
• B. Marketing.
• C. IT or Security per incident response plan.
• D. Facilities.

Answer: (C)

When a data security incident occurs, the designated path is to report it to IT or Security according to the incident response plan. These teams are equipped with the tools, authority, and procedures to detect, contain, and investigate security events, classify their severity, preserve evidence, and coordinate any required notifications to leadership, legal, or regulatory bodies. Following the plan ensures a swift, organized response and reduces the risk of further damage.

HR, Marketing, and Facilities handle their own specialized domains and are not structured to manage technical security incidents. Involving them directly can slow containment, risk exposing sensitive details, and bypass the established escalation and communication channels that IT or Security use to mobilize the right resources quickly.