A government organization responsible for critical infrastructure is being attacked and files on the server been deleted. Which of the following are…

For a government organization managing critical infrastructure, an active attack with data destruction is a national security event. The most immediate communications are to entities that can provide specialized, high-level response and initiate legal/investigative processes. A national Computer Emergency Response Team (CERT) or Cybersecurity and Incident Response Team (CSIRT), such as CISA in the U.S., is the primary point of contact for expert technical assistance, threat intelligence sharing, and coordinating a national-level response. Simultaneously, law enforcement must be notified immediately because the attack is a criminal act against critical infrastructure, and their involvement is essential for evidence preservation, investigation, and attribution.

B. Notifying the media is a public relations function that occurs later in the incident response process, once facts are established, to avoid causing public panic or compromising the investigation.

D. Notifying the relevant vendor is a subsequent step, taken only after initial analysis suggests a specific product vulnerability is being exploited. It is not the primary, immediate communication.

E. While a mitigation expert is needed, the national CERT/CSIRT is the primary coordinating body of such experts and the correct initial point of contact for a critical infrastructure incident.

1. NIST Special Publication 800-61 Rev. 2

"Computer Security Incident Handling Guide": Section 3.3.2

"Reporting

" states that for significant incidents

organizations should report to external bodies

including US-CERT (now part of CISA) and law enforcement agencies. An attack on critical infrastructure qualifies as a significant incident requiring such external reporting.

2. Cybersecurity and Infrastructure Security Agency (CISA)

"Report an Incident": CISA's official guidance designates itself as the central federal entity for analyzing and responding to cyber incidents

particularly for Federal Civilian Executive Branch agencies and critical infrastructure partners. The guidance explicitly encourages immediate reporting to CISA and/or the FBI. (Source: cisa.gov/report)

3. Carnegie Mellon University

Software Engineering Institute

"Defining Incident Management Processes for Critical Infrastructure

" CMU/SEI-2005-TN-029: This report emphasizes the necessity of robust communication and coordination plans for critical infrastructure protection. It highlights interactions with external entities

including "national-level incident response teams" and "law enforcement agencies

" as fundamental components of the incident management process (Section 4.3

"Interaction with External Entities").