Which is a correct practice for maintaining incident-related security documentation?

Which is a correct practice for maintaining incident-related security documentation?

• A. Delete incident logs after resolution
• B. Share incident details publicly
• C. Ensure records are accurate, accessible, and auditable
• D. Ignore minor incidents

Answer: (C)

Incident-related security documentation must be maintained so that records are accurate, accessible to authorized personnel, and auditable. Accurate records ensure the details of what happened, when it occurred, which assets were involved, what actions were taken, and who reviewed or approved those actions are correct and complete. Accessibility means the right people can retrieve the information quickly for investigations, remediation, and audits, while still protecting sensitive data. Auditable records provide a clear trail of who accessed or changed the information, when, and why, with proper timestamps and ownership, so integrity and accountability can be verified over time. Together, these qualities support effective investigations, regulatory or client audits, and ongoing improvement by allowing reliable analysis of incident patterns and responses. Deleting logs erases the evidence trail, publicly sharing details can expose vulnerabilities, and ignoring minor incidents misses chances to learn and strengthen defenses.

Incident-related security documentation must be maintained so that records are accurate, accessible to authorized personnel, and auditable. Accurate records ensure the details of what happened, when it occurred, which assets were involved, what actions were taken, and who reviewed or approved those actions are correct and complete. Accessibility means the right people can retrieve the information quickly for investigations, remediation, and audits, while still protecting sensitive data. Auditable records provide a clear trail of who accessed or changed the information, when, and why, with proper timestamps and ownership, so integrity and accountability can be verified over time. Together, these qualities support effective investigations, regulatory or client audits, and ongoing improvement by allowing reliable analysis of incident patterns and responses. Deleting logs erases the evidence trail, publicly sharing details can expose vulnerabilities, and ignoring minor incidents misses chances to learn and strengthen defenses.