If you witness a token security violation, which action should be taken first?

• A. Report the violation to the NETCOM RA Office
• B. Report the violation to the local ISSO
• C. Take no action
• D. Escalate to commanding officer for immediate review

Answer: (A)

The first thing to do is report the incident to the designated security authority so it can be logged and handled properly from the outset. Reporting to the NETCOM RA Office ensures the event goes into the official record and is triaged by the team responsible for initial assessment and escalation. They coordinate with the right security stakeholders, including the local ISSO, to guide follow-on actions. Taking no action is not acceptable, and bypassing the official reporting path by escalating directly to a commanding officer can delay proper containment and coordination. Reporting to the NETCOM RA Office sets the right process in motion from the start.