A data destruction incident is detected affecting borrower data. Which sequence is the correct PLM response?

• A. Contain the incident, notify affected parties, recover data, and review security controls.
• B. Notify affected parties, recover data, and review security controls.
• C. Contain the incident, recover data, and notify affected parties.
• D. Contain the incident and notify affected parties, then recover data.

Answer: (B)

When a data destruction incident affects borrower data, timely communication and rapid restoration are the top priorities, followed by strengthening defenses to prevent recurrence. The sequence that starts with notifying affected parties aligns with breach notification requirements and stakeholder obligations, ensuring transparency and regulatory compliance as soon as the incident is confirmed. After notification, focus on recovering the lost data to restore services and protect borrowers’ interests. Once data is back and operations are stable, review and tighten security controls to close gaps and reduce the chance of a similar incident happening again. Other sequences tend to delay notification or recovery, which can increase legal risk or prolong disruption, so this order best addresses both regulatory responsibility and operational continuity.