An intern spots a recurring phishing pattern in city email but only mentions it to a friend who works at another agency. What is the correct next step for information-risk reporting?
Select an answer to reveal the explanation.
Short Explanation
Telling a buddy at another shop feels helpful, but it is like spotting a leak and texting a neighbor instead of calling your building desk. Information risks belong on the internal reporting path so your own org can act. Friendly outside chat does not replace that duty.
Full Explanation
Information-risk patterns such as recurring phishing in city email must enter the organization's internal hierarchy pathway so security, IT, and risk owners can act. Mentioning the pattern only to a friend at another agency leaves the home organization blind and may mishandle sensitive indicators. Posting on social media can tip adversaries and violates controlled disclosure. Waiting for a successful breach before reporting abandons prevention. Keeping the tip informal and asking the friend to escalate externally still skips the internal owner. Exam caveat: internal escalation of information risks beats informal external chatter as the first duty. Operational check: file the phishing pattern through the city's designated security or risk intake the same day, attach sample headers if allowed, and confirm a ticket number reaches the information-security owner. Share sanitized lessons with peer agencies only through approved ISACs or formal channels after internal triage—not as a substitute for reporting at home. In municipal practice, record the rationale in the risk procedure or committee minutes so future staff apply the same rule under budget pressure. Re-validate the control after the next seasonal peak or org-chart change to confirm the civic pathway still works as designed.