During incident triage, what step follows assessing severity and risk?

• A. Document findings and escalate if necessary.
• B. Determine immediate risk before any action.
• C. Implement controls to mitigate immediate risk.
• D. Notify regulatory authorities immediately.

Answer: (C)

In incident triage, the priority after assessing how severe the incident is and what risk it poses is to implement controls that mitigate the immediate danger. By putting quick containment measures in place—such as isolating the affected area, stopping hazardous actions, or applying temporary safeguards—you reduce potential harm while the incident is further evaluated and managed. Documentation and escalation are essential next steps, but they follow the initial containment actions. Determining the immediate risk is part of the initial assessment itself, not a separate action after putting controls in place, and notifying regulatory authorities is not typically the immediate triage step unless specifically required by policy or law.