How are incident severities commonly classified, and what actions correspond to each level?

• A. Low/Informational: monitor and record; Medium: contain and escalate to supervisors; High/Critical: activate incident command and notify emergency services.
• B. Low/Informational: escalate to executive leadership; Medium: shut down systems; High/Critical: evacuate all facilities.
• C. Informational: delete logs; Medium: delay reporting; High: hide the incident.
• D. Low: ignore; Medium: document; High: celebrate.

Answer: (A)

Classifying incidents by how much they affect operations and what kind of response they require drives the right actions. For a low or informational level, the emphasis is on observation and documentation—keep an eye on the situation and record what happens so you have a clear, auditable trail without pulling in heavy resources. When the impact is medium, the goal shifts to containing the issue and escalating to those who can authorize more substantial steps; containment prevents spread while management or the incident response team decides on the next moves. At a high or critical level, a formal incident command is activated and external notification is triggered, including emergency services if there’s real danger or major disruption. This approach keeps responses proportional, protects evidence, and ensures that the right people are involved at the right time.

Other options push actions that don’t fit standard security practice, such as deleting logs or delaying reporting, which harms evidence and situational awareness; hiding or ignoring the incident, or celebrating it, which undermines safety and accountability.