In responding to a data breach affecting client data, which option reflects the appropriate sequence of actions?

• A. Immediately publicize the breach on social media to mitigate suspicion.
• B. Contain and assess breach, notify stakeholders and authorities per policy and law, investigate root cause, remediate security gaps, and document actions and outcomes.
• C. Do nothing during the incident.
• D. Blame an external vendor publicly.

Answer: (B)

Structured incident response hinges on a sequence that first contains the breach to limit damage, then assesses the impact, and then follows a compliant path for notification, investigation, remediation, and documentation. Contain and assess set the foundation so you know what happened and who is affected. Notifying stakeholders and authorities per policy and law ensures legal obligations are met and keeps clients informed. Investigating the root cause reveals how the breach occurred and where security gaps lie, which then guides targeted remediation to prevent recurrence. Documenting actions and outcomes creates an auditable trail for accountability and continuous improvement.

Public posting on social media before containment can spread misinformation and hinder the investigation, doing nothing is obviously unacceptable, and publicly blaming a vendor avoids taking responsibility and can undermine the investigation and accountability.