Turn SOPs into Quiz-Ready Training

## SOP: Phishing Incident Response

1. User reports suspected phishing to security@company.com.
2. SOC analyst classifies the email within 1 hour:
   - Confirmed phishing → escalate to Tier 2.
   - Spam / non-malicious → close ticket with note.
3. For confirmed phishing:
   a. Block sender at email gateway.
   b. Search mailboxes for additional recipients.
   c. Force password reset for any user who clicked the link.
   d. Notify CISO if more than 5 users are affected.
4. Document the incident in the IR tracker within 24 hours.

1. 1. What is the SLA for initial classification of a reported phishing email?
   • A. 15 minutes
   • B. 1 hour ✓
   • C. 4 hours
   • D. 24 hours
   Rationale: The SOC analyst must classify the report within 1 hour.
2. 2. When must the CISO be notified?
   • A. On every report
   • B. Only confirmed phishing
   • C. When more than 5 users are affected ✓
   • D. Only when credentials are stolen
   Rationale: CISO notification is required when more than 5 users are affected.
3. 3. What is the deadline for documenting the incident in the IR tracker?
   • A. 1 hour
   • B. 4 hours
   • C. 24 hours ✓
   • D. 72 hours
   Rationale: Incident documentation must be completed within 24 hours.