What do employees need to know to report a security incident?

A.
How to report an incident and to whom.

B.
Whether the incident has occurred before and what was the resulting damage.

C.
The measures that should have been taken to prevent the incident in the first place.

D.
Who is responsible for the incident and whether it was intentional.

Explanation:
The purpose of the incident management process is to ensure that incidents and weaknesses that are related to information systems are known so that appropriate measures can be taken in a timely manner.
Staff, temporary personnel and external users should all be made aware of the procedures for reporting the various types of incidents and weaknesses that can have an influence on the reliability of the information and the security of the business assets.
Staff and users should be required to report all incidents and weaknesses as quickly as possible to the service desk or a contact person.