An event must already have caused measurable damage before an organization can classify it as a cybersecurity incident.

### Why this is right The statement is false because an incident may threaten confidentiality, integrity, or availability even before measurable damage has occurred. Potential harm can justify investigation and response. ### The concept Incident classification is not limited to damage already completed. A credible compromise in progress, such as an attacker gaining administrator privileges, can be an incident even if no data has yet been stolen. By contrast, an isolated failed login may be only an event until additional evidence indicates a meaningful threat. The organization uses its plan and severity criteria to decide when to investigate, escalate, and formally track activity. ### The other options - **The statement is false**: Actual harm is not required; a credible potential threat can meet the incident threshold. ### Watch out Do not confuse proof of completed damage with evidence of a real or likely threat. Response should not wait for avoidable harm. ### Terms - **Confidentiality**: Protection against unauthorized disclosure of information. - **Integrity**: Protection against improper alteration or destruction. - **Availability**: Reliable access to systems and information when needed. ### Remember A credible threat to the confidentiality, integrity, or availability of an asset can be an incident before damage is confirmed.