If borrower data is destroyed or encrypted, what is the correct sequence for a PLM’s response?

• A. Contain the incident, notify affected parties, recover data, and review security controls.
• B. Notify affected parties, recover data, and review security controls.
• C. Contain the incident, notify affected parties, recover data, and review security controls.
• D. Contain the incident, recover data, notify affected parties, and review security controls.

Answer: (C)

Containing the incident first is essential to stop further data loss and to preserve evidence. By isolating affected systems and preventing spread, you limit the damage and create a stable situation in which you can accurately assess scope and impact.

Only after the incident is contained can you determine who needs to be notified and what information may have been exposed. This ensures notification is accurate, timely, and aligned with policy and regulatory requirements, reducing confusion for affected borrowers.

With containment and notification established, you can proceed to recover data and restore normal operations. Recovering from clean backups and validating systems before bringing them back online minimizes the risk of reinfection or data corruption.

Finally, review and strengthen security controls to prevent a recurrence. Conduct a root-cause analysis, patch vulnerabilities, update policies, and reinforce training so protections improve moving forward.

This order—contain, notify, recover, review—best supports rapid mitigation, regulatory compliance, operational continuity, and ongoing defense.