During a data encryption incident involving borrower data, which sequence aligns with standard PLM protocol?

• A. Contain the incident, notify affected parties, recover data, and review security controls.
• B. Contain the incident and notify affected parties, then recover data.
• C. Notify affected parties, recover data, and review security controls.
• D. Contain the incident, recover data, and notify affected parties.

Answer: (B)

The main idea here is the order of actions in an incident response: stop the spread of the breach, communicate with those affected, and then restore operations. Containing the incident quickly limits further data exposure. Prompt notification of affected borrowers is crucial for regulatory compliance and for them to take protections, so it should happen alongside containment rather than after everything else. Once containment and notification are in place, you focus on recovering data to resume normal business processes.

Other sequences delay essential steps or mix in recovery before giving affected parties notice, which can extend risk and run afoul of breach-disclosure expectations. While reviewing security controls is important, it typically follows once operations are stabilized, so it isn’t the immediate priority in the core response sequence.