________ applies when an incident occurs or Intel received.

• A. Alpha
• B. Bravo
• C. Charlie
• D. Delta

Answer: (C)

In this coding scheme for incident response, the moment an event happens or new intelligence is received is the trigger to activate the defined response procedures. Charlie is the label used for that moment—signaling that an incident has occurred or intel has been received and that the formal response process should begin. This makes it the best fit for the described condition because it directly marks the transition from detection or receipt of information to active management of the incident. The other codes line up with different moments in the lifecycle (initial alert, ongoing assessment, or post-incident status), which is why they don’t match the scenario as well as Charlie.