2 cissp ® Official Study Guide Eighth Edition

Mitigation 
Mitigation steps attempt to contain an incident. One of the primary goals of an effective 
incident response is to limit the effect or scope of an incident. For example, if an infected 
computer is sending data out its network interface card (NIC), a technician can disable the 
NIC or disconnect the cable to the NIC. Sometimes containment involves disconnecting a 
network from other networks to contain the problem within a single network. When the 
problem is isolated, security personnel can address it without worrying about it spreading 
to the rest of the network. 
In some cases, responders take steps to mitigate the incident, but without letting the 
attacker know that the attack has been detected. This allows security personnel to monitor 
the attacker’s activities and determine the scope of the attack.
Reporting 
Reporting refers to reporting an incident within the organization and to organizations and 
individuals outside the organization. Although there’s no need to report a minor malware 
infection to a company’s chief executive offi cer (CEO), upper-level management does need 
to know about serious security breaches. 
As an example, the WannaCry ransomware attack in 2017 infected more than 230,000 
computers in more than 150 countries within a single day. The malware displayed a mes-
sage of “Ooops your fi les have been encrypted.” The attack reportedly infected parts of the 
United Kingdom’s National Health Service (NHS) forcing some medical services to run on 
an emergency-only basis. As IT personnel learned of the impact of the attack, they began 
reporting it to supervisors, and this reporting very likely reached executives the same day 
the attack occurred. 
Organizations often have a legal requirement to report some incidents outside of the 
organization. Most countries (and many smaller jurisdictions, including states and cities) 
have enacted regulatory compliance laws to govern security breaches, particularly as they 
apply to sensitive data retained within information systems. These laws typically include a 

---

Managing Incident Response 
743
requirement to report the incident, especially if the security breach exposed customer data. 
Laws differ from locale to locale, but all seek to protect the privacy of individual records 
and information, to protect consumer identities, and to establish standards for fi nancial 
practice and corporate governance. Every organization has a responsibility to know what 
laws apply to it and to abide by these laws. 
Many jurisdictions have specifi c laws governing the protection of personally identifi able 
information (PII). If a data breach exposes PII, the organization must report it. Different 
laws have different reporting requirements, but most include a requirement to notify indi-
viduals affected by the incident. In other words, if an attack on a system resulted in an 
attacker gaining PII about you, the owners of the system have a responsibility to inform 
you of the attack and what data the attackers accessed. 
In response to serious security incidents, the organization should consider reporting 
the incident to offi cial agencies. In the United States, this may mean notifying the Federal 
Bureau of Investigations (FBI), district attorney offi ces, and/or state and local law enforce-
ment agencies. In Europe, organizations may report the incident to the International 
Criminal Police Organization (INTERPOL) or some other entity based on the incident and 
their location. These agencies may be able to assist in investigations, and the data they col-
lect may help them prevent future attacks against other organizations. 
Many incidents are not reported because they aren’t recognized as incidents. This is 
often the result of inadequate training. The obvious solution is to ensure that personnel 
have relevant training. Training should teach individuals how to recognize incidents, what 
to do in the initial response, and how to report an incident.