A PLM encounters a data destruction incident impacting borrower data. Which sequence is correct?

• A. Contain the incident and notify affected parties, then recover data and review security controls.
• B. Contain the incident, notify affected parties, recover data, and review security controls.
• C. Notify affected parties, contain the incident, recover data, and review security controls.
• D. Contain the incident, recover data, notify affected parties, and review security controls.

Answer: (C)

When borrower data is at risk, the priority is to address regulatory and stakeholder obligations quickly while beginning actions to stop the incident. Notifying affected parties promptly helps comply with breach notification laws and preserves trust, making it the first step in this sequence. After that, containing the incident is essential to stop further data destruction and to preserve evidence for investigation. Once the incident is contained, you can recover or restore the data and then review security controls to prevent a recurrence. Approaches that delay notification risk penalties and damage to trust, while trying to recover data before containment can allow ongoing damage. In practice, containment and notification can occur in parallel, but initiating with notifying affected parties aligns with compliance requirements and keeps the response moving in a responsible order.