A data destruction incident affecting borrower information requires a response sequence. Which option lists the steps in the correct order?

• A. Notify affected parties, contain the incident.
• B. Contain the incident and recover data.
• C. Notify affected parties, recover data, and review security controls.
• D. Contain the incident, notify affected parties, recover data, and review security controls.

Answer: (D)

When handling a data destruction incident, you start by stopping the spread of the issue. Containing the incident neutralizes the immediate risk and prevents further borrower data from being exposed or damaged. Once the incident is under control, you notify affected parties to meet legal and contractual obligations and to give them a chance to take protective steps. After notification, you focus on recovering data and restoring normal operations so services and data integrity are brought back online. Finally, you review security controls to understand what failed and to strengthen defenses to prevent a recurrence.

This sequence—contain, notify, recover, review—is why the correct choice is best: it follows the logical order of stopping the threat, meeting notification duties, restoring systems, and then reinforcing protections. The other options omit containment, misplace notification relative to recovery, or skip the post-incident review, which would leave gaps in protection or compliance.