What are common indicators of a security incident requiring escalation under Annex F?

• A. Normal routine maintenance window notices.
• B. Unusual authentication failures, abnormal traffic, alerts from monitoring, data exfiltration signs.
• C. Regular software update notifications.
• D. A single failed login attempt.

Answer: (B)

Under Annex F, escalation is prompted by signals that something unusual or potentially harmful is occurring, not by routine activity. The set that includes unusual authentication failures, abnormal traffic, alerts from monitoring, and signs of data exfiltration best fits this idea because each element points to potential compromise or active incident. Unusual authentication failures can indicate credential theft or brute-force attempts. Abnormal traffic patterns may reveal unauthorized access, lateral movement, or data being moved out of the network. Alerts from monitoring systems reflect detections of anomalies or policy violations. Signs of data exfiltration are a direct indication that data is leaving the environment, signaling a high-severity incident. In contrast, routine maintenance window notices, regular software update notifications, or a single failed login are common, non-escalating events and don’t by themselves signify an ongoing security incident requiring escalation.