In case of electronic spillage, who must be notified?

• A. Notify security manager or commanding officer of the incident, as well as their CoC
• B. Notify local police only
• C. Notify security manager or commanding officer and their CoC
• D. Do nothing for 24 hours

Answer: (C)

Prompt escalation to the right authority is essential when electronic spillage occurs. The designated security manager or commanding officer leads the initial response, coordinating containment, investigation, and documentation. Bringing in their chain of command ensures proper oversight, authorization for actions, and timely reporting up the line of leadership, so the incident is managed consistently and in accordance with policy. Relying on local police alone misses the internal process, risk assessment, and recordkeeping that organizations are required to perform. Delaying action or doing nothing for 24 hours can allow further data exposure and hinders the ability to contain the incident effectively. This approach keeps the response organized, traceable, and compliant with information security requirements.