When responding to a borrower data destruction incident, which sequence correctly includes all four key steps?

• A. Contain the incident, notify affected parties, recover data, and review security controls.
• B. Notify affected parties, recover data, and review security controls.
• C. Contain the incident, recover data, notify affected parties, and review security controls.
• D. Contain the incident and notify affected parties, then recover data.

Answer: (C)

The sequence starts with containment to stop further damage and keep the incident from spreading. Once the situation is contained, the next focus is recovering data to restore operations and verify what can be recovered, which is essential before communicating status to affected parties. After you have a clear picture of the impact, you notify those who are affected in a timely and compliant manner. Finally, you review security controls to identify weaknesses and implement improvements to prevent a recurrence. Notifying before data recovery can lead to incomplete or inaccurate information and delays in restoration, while omitting containment or the post-incident review leaves ongoing risk or missed learning opportunities.