Which practice facilitates reporting phishing and security incidents?

• A. OS patching
• B. Incident reporting culture
• C. Encryption at rest
• D. Data classification

Answer: (B)

Encouraging an incident reporting culture is about creating an environment where people feel safe to report phishing and other security events, know exactly how to report them, and see that their reports are taken seriously. When employees can flag suspicious emails without fear of blame, security teams receive timely signals that enable quick triage, containment, and remediation. This culture also drives learning: after an incident, the team can review what happened, adjust training, update filters, and strengthen defenses to prevent repeats.

Other controls like patching software, encrypting data at rest, or classifying data are vital for reducing risk in different ways, but they don’t by themselves establish the channel and mindset needed to report incidents rapidly.