If an unauthorized wireless access point is detected, what must the incident response plan define?

If an unauthorized wireless access point is detected, what must the incident response plan define?

• A. Ignore the event
• B. Log only
• C. Notify external regulators
• D. Define and require a response

Answer: (D)

When a rogue wireless access point is detected, the incident response plan must specify a defined, actionable response. This isn’t about just logging the event or leaving it for later; it requires clear steps, roles, and timelines so the organization can contain, eradicate, and recover from the incident promptly. A well-crafted plan assigns responsibilities (who responds), outlines containment actions (for example, isolating the device or blocking its traffic), and details escalation and communication procedures, plus steps for evidence collection and post-incident review. External regulator notification isn’t automatically required for every rogue AP incident; that depends on applicable laws or contractual obligations. The key requirement is having a documented process that mandates a timely, coordinated response to such incidents, ensuring consistent handling and reducing the risk to cardholder data.

When a rogue wireless access point is detected, the incident response plan must specify a defined, actionable response. This isn’t about just logging the event or leaving it for later; it requires clear steps, roles, and timelines so the organization can contain, eradicate, and recover from the incident promptly. A well-crafted plan assigns responsibilities (who responds), outlines containment actions (for example, isolating the device or blocking its traffic), and details escalation and communication procedures, plus steps for evidence collection and post-incident review.

External regulator notification isn’t automatically required for every rogue AP incident; that depends on applicable laws or contractual obligations. The key requirement is having a documented process that mandates a timely, coordinated response to such incidents, ensuring consistent handling and reducing the risk to cardholder data.