Incident reports from the organization's three regions show that similar incidents are rated differently, so senior management cannot compare risk across regions. What should the information security manager do?
Select an answer to reveal the explanation.
Short Explanation
If three referees use three rulebooks, you can't compare the scores. One classification scheme, applied the same way everywhere, lets you finally see where the real risk is. Reporting each region separately is the trap; it hides the inconsistency instead of fixing it.
Full Explanation
Consistent incident classification is what makes incident data useful for enterprise risk management. A single scheme with common definitions of category and severity, based on organization-wide impact criteria, means a given incident receives the same rating wherever it occurs. Training and periodic calibration across regions keep application consistent, while allowing regions to supply local context through the impact criteria themselves. Letting each region keep its own scheme preserves the inconsistency that prevents comparison, and local understanding of impact can be built into a common scheme rather than requiring separate ones. Having the central team reclassify every regional incident adds delay and duplication, and because reclassification happens after the response, regional escalation decisions would still be based on inconsistent ratings. Reporting each region separately sidesteps the problem without solving it; management still cannot compare risk, which is the stated need. Exam caveat: regional legal requirements, such as differing notification rules, can be handled as additional criteria within the common scheme rather than as separate schemes. Operational check: give the same set of sample incidents to analysts in each region and confirm they reach the same category and severity.