A violation of a company security policy is described as a

• A. Security incident
• B. Breach
• C. Identity theft
• D. Phishing

Answer: (A)

Think of security incidents as events that affect the organization’s security, including policy violations. A violation of a company security policy is described as a security incident because it represents a potential risk to security and typically triggers an investigation and response, even if no data has been stolen. It’s a broad category that covers misuse, attempted access, or other actions that go against policy.

A breach, by contrast, refers specifically to unauthorized access to or exfiltration of data—a more precise outcome than a general policy violation. Identity theft is a crime where someone uses another person’s identity, which can result from various attacks but is not the general term for a policy violation. Phishing is a technique attackers use to deceive people into revealing information, not a description of the violation itself.