A statement best characterizes a computer security incident?

• A. A routine backup operation
• B. A violation or imminent threat of violation of computer security policies, acceptable use policies, or standard security practices.
• C. A software patch deployment
• D. A system upgrade

Answer: (B)

A computer security incident is defined by a violation or imminent threat of violation of security policies, acceptable use policies, or standard security practices. This centers on events that compromise or threaten the organization’s information security, not routine IT tasks. Routine backups, patch deployments, and system upgrades are normal maintenance activities that support security and availability; they become incidents only if they involve a policy violation or an active security problem. So the statement about a violation or imminent threat to security policy best characterizes a security incident.