A PLM faces a data destruction or encryption incident affecting borrower records. Which sequence best describes the recommended response?

A PLM faces a data destruction or encryption incident affecting borrower records. Which sequence best describes the recommended response?

• A. Contain the incident, notify affected parties, recover data, and review security controls.
• B. Contain the incident and notify affected parties.
• C. Notify affected parties, recover data, and review security controls.
• D. Contain the incident, recover data, and notify affected parties.

Answer: (A)

The sequence tests how to respond to a data compromise by prioritizing immediate containment, timely communication, recovery, and improvement. Containing the incident first stops further data exposure and helps preserve evidence for investigation. Once the incident is contained, notifying affected parties is essential to meet legal requirements and give individuals the opportunity to take protective steps, reducing harm and demonstrating responsible handling. After that, focus on recovering data and restoring operations, ensuring backups are intact and systems are clean before resuming normal business. Finally, review security controls and implement improvements to prevent recurrence, learning from what happened and strengthening defenses. Delaying notification, starting with notification before containment, or skipping the post-incident review would hamper both regulatory compliance and effective remediation, which is why this order is the best fit.

The sequence tests how to respond to a data compromise by prioritizing immediate containment, timely communication, recovery, and improvement. Containing the incident first stops further data exposure and helps preserve evidence for investigation. Once the incident is contained, notifying affected parties is essential to meet legal requirements and give individuals the opportunity to take protective steps, reducing harm and demonstrating responsible handling. After that, focus on recovering data and restoring operations, ensuring backups are intact and systems are clean before resuming normal business. Finally, review security controls and implement improvements to prevent recurrence, learning from what happened and strengthening defenses.

Delaying notification, starting with notification before containment, or skipping the post-incident review would hamper both regulatory compliance and effective remediation, which is why this order is the best fit.