The correct answer is C because the first step after an incident is reported is to validate whether the reported event is actually an incident. Validation helps prevent unnecessary escalation, disruption, or incorrect response actions. The incident handler should confirm the event by reviewing available evidence, logs, alerts, user reports, system behavior, or other indicators. After validation, the handler can classify the incident, determine severity, assess scope, notify appropriate parties, and begin containment or eradication according to the incident response plan. Notifying parties before validation may cause confusion or unnecessary escalation.
Determining scope is important, but it should occur after confirming that an incident exists. Powering off the system may destroy volatile evidence, disrupt business operations, or worsen the situation if done without analysis. CISM incident management principles require orderly identification, validation, classification, escalation, and response. Therefore, validating the incident is the correct first action for the incident handler.
Reference: CISM Information Security Incident Management; incident identification, validation, classification, escalation, and response handling principles.