ROARR is an acronym used in incident planning. What is the first word represented by ROARR?

• A. Report
• B. Observe
• C. Anticipate
• D. React

Answer: (A)

In incident planning, ROARR guides actions in a sequence, and the first word is Report because you cannot begin the response without notifying the right people that an incident has occurred. Reporting kicks off the incident command process, alerts security, supervisors, and, if needed, external responders, and creates the initial record of what happened, where, and who is involved. This prompt notification enables the rest of the steps to unfold effectively: Observe to assess the scene, Anticipate potential developments to stay ahead of risks, React with appropriate containment and actions, and Recover to restore operations and learn from what happened. Observing and forecasting are important, but they rely on the incident being officially reported to start the process. React and Recover follow, guided by the information gathered through reporting and observation.