A PLM discovers a data destruction incident affecting borrower records. Which sequence correctly outlines the response steps?

• A. Contain the incident, notify affected parties, recover data, and review security controls.
• B. Notify affected parties, contain the incident, recover data, and review security controls.
• C. Contain the incident, recover data, and notify affected parties.
• D. Contain the incident, notify affected parties, recover data, and review security controls.

Answer: (D)

The sequence tested is how to respond to a data destruction incident in a way that stops ongoing harm, informs those affected, restores operations, and improves defenses. You want to contain the incident first so you stop any further loss of borrower data. Once containment is in place, you assess the impact and notify affected parties as required by policy and law. After people are informed, you work to recover the data and restore normal operations. The final step is to review and strengthen security controls to prevent a recurrence and address gaps revealed by the incident.

Starting with notifying affected parties before containment would risk broader exposure and mischaracterize the scope; skipping the post-incident review would miss essential improvements. The listed sequence that begins with containment, then notification, then recovery, and finally reviewing security controls reflects the appropriate order for an effective incident response.