Page 189 - CyberSecurityEssentialsEnglish
P. 189
● Remember: learn from the near miss
If an error is caught before harm occurs, do not treat it as a complete success. Record it
briefly: what nearly happened? Where was it caught? Which control worked, and which
was missing? Many large incidents begin with near misses a team never learned from,
because they happened to end safely.
FIGURE 4-10: THE RESPONSE CYCLE FOR AN AI INCIDENT
What to notice: The order of response begins with stopping the harm, containing it, and
preserving the evidence, then notifying, correcting, and learning.
Source: Prepared by the author.
TABLE 4-18: THE LEVEL OF AN INCIDENT AND THE FIRST RESPONSE
Level Example The response
Imprecise wording that was never
Low Correct it locally and record the lesson.
used externally.
A wrong summary that reached an Stop the distribution, review the scope,
Medium
internal team. and notify the responsible officer.
Immediate containment and
Confidential data uploaded, or a
High notification of security, privacy, or
wrong consequential decision sent.
management.
Activate the emergency plan with
A wide leak, financial fraud, or
Critical multiple specialists and senior
repeated harmful execution.
management.
188
