When borrower data is compromised by destruction or encryption, what sequence should guide the PLM's actions?

When borrower data is compromised by destruction or encryption, what sequence should guide the PLM's actions?

• A. Contain the incident and notify affected parties, then recover data.
• B. Notify affected parties, recover data, and review security controls.
• C. Contain the incident, notify affected parties, recover data, and review security controls.
• D. Contain the incident, recover data, and notify affected parties.

Answer: (C)

When borrower data is compromised, act in a disciplined incident response sequence that first limits the damage, then handles legal and notification obligations, restores operations, and finally strengthens defenses. Containing the incident right away stops further data loss or destruction. After containment, notifying affected parties is essential to meet legal and regulatory obligations and to manage risk and trust. Once notification is underway or completed, focus on recovering data and restoring normal operations so borrowers can be served again and systems are back to a safe state. Finally, review and improve security controls based on what happened to prevent a recurrence. This order—contain, notify, recover, then review controls—ensures damage is minimized, compliance is met, operations are restored promptly, and defenses are strengthened for the future.

When borrower data is compromised, act in a disciplined incident response sequence that first limits the damage, then handles legal and notification obligations, restores operations, and finally strengthens defenses. Containing the incident right away stops further data loss or destruction. After containment, notifying affected parties is essential to meet legal and regulatory obligations and to manage risk and trust. Once notification is underway or completed, focus on recovering data and restoring normal operations so borrowers can be served again and systems are back to a safe state. Finally, review and improve security controls based on what happened to prevent a recurrence. This order—contain, notify, recover, then review controls—ensures damage is minimized, compliance is met, operations are restored promptly, and defenses are strengthened for the future.