On a Tuesday night, a database administrator performs some off-hours maintenance on several production database servers. The administrator notices some unfamiliar and unusual directory names on one of the servers. After reviewing the directory listings and viewing some of the files, the administrator concludes that the server has been attacked and calls the incident response team for assistance. The teams investigation determines that the attacker successfully gained root access to the server six weeks ago.

Would the organization consider this activity to be an incident? If so, which of the organization's policies does this activity violate? (Section 2.1)

What measures are in place to attempt to prevent this type of incident from occurring or to limit its impact? (Section 3.1.2)