When borrower data is compromised due to destruction or encryption, which sequence should guide the PLM’s actions?

• A. Contain the incident, notify affected parties, recover data, and review security controls.
• B. Contain the incident, notify affected parties, recover data and review security controls.
• C. Notify affected parties, recover data, and review security controls.
• D. Contain the incident and notify affected parties, then recover data.

Answer: (A)

The sequence tested reflects how a PLM should respond to a borrower data breach caused by destruction or encryption. First, contain the incident to stop further data exposure and limit damage. Next, notify affected parties to meet legal obligations and maintain trust, since many regulations require timely communication after a breach. Then proceed to recover data and restore operations so services can resume. Finally, review and strengthen security controls based on what was learned to prevent a similar incident in the future. This order prioritizes stopping harm and informing stakeholders before repairing and hardening the system, which is essential when data integrity has been compromised.