Which activity best describes the focus of hourly BES incident reporting in cyber contexts?

• A. Public notification
• B. Detailed forensic analysis
• C. Timely escalation and initial containment steps
• D. Regulatory filing updates

Answer: (C)

Hourly BES incident reporting in cyber contexts is all about getting the right people involved quickly and starting actions to contain the incident right away. The goal is to escalate to the appropriate incident response and control teams within the hour and implement initial containment steps to limit spread and impact on the grid. Public notification, while important, isn’t the immediate focus of hourly reporting and usually follows containment through established channels. Detailed forensic analysis is valuable but typically occurs after the initial containment is in place, since it can take time and should not delay immediate response. Regulatory filing updates are administrative and not the primary action driven by hourly reporting.