In handling a borrower data disruption caused by destruction or encryption, which sequence should a PLM follow?

• A. Notify affected parties, recover data, and review security controls.
• B. Contain the incident, notify affected parties, recover data, and review security controls.
• C. Contain the incident and notify affected parties, then recover data.
• D. Contain the incident, recover data, and notify affected parties.

Answer: (B)

The sequence tested is about proper incident response timing and order. Start by containing the incident to stop the attacker or the disruption from doing more damage, which is essential when data is being destroyed or encrypted. Once containment is in place and the immediate threat is halted, you notify affected parties as required by laws and contracts. Prompt notification helps meet regulatory obligations and preserve trust, but it should come after you’ve contained the spread to avoid signaling weaknesses or expanding the breach. After people are informed, you focus on recovering data to restore operations, using verified backups and ensuring data integrity. Finally, you review security controls to identify weaknesses, apply fixes, and strengthen defenses to prevent a similar incident in the future.

Other sequences fall short because they skip containment, delay or precede notification with containment, or omit the post-incident review of controls, which is critical for closing gaps and reducing future risk.