An incident team's reports are unreliable because analysts use a single field to record both the kind of incident, such as phishing or malware, and how serious it is. What should the information security manager do?
Select an answer to reveal the explanation.
Short Explanation
What happened and how bad it is are two different questions, so they deserve two different answers. A phishing email can be trivial or catastrophic depending on what it hit. Assuming the type tells you the severity is the trap; you need both fields, rated separately.
Full Explanation
Incident classification usually has two dimensions. Category describes the type of incident, such as phishing, malware, unauthorized access or data loss, and helps route the incident to the right playbook and track trends by threat. Severity describes the impact on the business and drives priority, escalation and response time. Keeping them separate makes both meaningful: a phishing incident may be low severity when blocked and critical when it leads to account takeover. Free-text descriptions are useful for detail but cannot be analyzed consistently, so reporting would become even less reliable. Rating incidents by type alone assumes each type has a fixed impact, which is false; impact depends on what assets, data and processes are affected. Removing severity from incident records and setting it only when reporting to management means it would not guide the response itself, which is its main purpose, and escalation would be delayed. Exam caveat: both dimensions should use defined, organization-wide values so that trends and comparisons are reliable. Operational check: confirm the incident record has distinct category and severity fields with defined values, and that a sample of recent incidents shows different severities within the same category.