An intern spots a recurring phishing pattern in city email but only mentions it to a friend who works at another agency. What is the correct next step for information-risk reporting?
Select an answer to reveal the explanation.
Short Explanation
Telling a buddy at another shop feels helpful, but it is like spotting a leak and texting a neighbor instead of calling your building desk. Information risks belong on the internal reporting path so your own org can act. Friendly outside chat does not replace that duty.
Full Explanation
Information risks must enter the organization's own escalation and reporting hierarchy so owners can investigate and control exposure. Informal external conversation may share awareness but does not fulfill internal reporting duty or create an auditable record. Waiting for confirmed harm delays treatment. Staff should use the documented internal pathway first.