In incident response during testing, what is the first step after detecting an issue?

• A. Escalate to management.
• B. Detect and document the issue.
• C. Implement mitigation.
• D. Notify users.

Answer: (B)

Capturing what’s observed and turning it into a record is the first move when something is detected in testing. Documenting the issue creates a reliable, shareable trail that everyone can refer to, which is essential for accurate triage and coordinated action. You want to note when it happened, which systems or components are affected, what symptoms or errors appeared, the initial impact, and any logs or telemetry you can gather. This groundwork makes it possible to assess severity, reproduce the issue if needed, and assign responsibility.

Escalation, mitigation, and notifying users are important steps, but they rely on having a clear, documented incident to guide them. Without that record, decisions can be misinformed or inconsistent. So the first, foundational action is to detect and document the issue.