What is the US-CERT incident category name and reporting timeframe for a CAT-3 incident?

• A. Malicious Code/Daily
• B. Malicious Activity/Hourly
• C. Unauthorized Access/Weekly
• D. Information Disclosure/Monthly

Answer: (A)

For CAT-3 incidents, the standard pairing is Malicious Code with a Daily reporting cadence. Malicious Code describes malware-related events such as infections, propagation, or detection of malicious software across systems. These incidents are serious enough to require coordinated response and ongoing visibility, but not so urgent that updates must be provided every hour. Daily reporting strikes a balance by keeping US-CERT and involved teams informed with timely status updates, containment actions, and remediation efforts.

The other pairings would imply different incident types or reporting speeds that don’t align with CAT-3. For example, a different category like Malicious Activity, Unauthorized Access, or Information Disclosure would typically correspond to a different CAT level, and choosing an hourly, weekly, or monthly cadence would not match the CAT-3 expectation.