Which sequence best reflects the immediate steps a PLM should take after identifying a data destruction incident affecting borrowers?

• A. Contain the incident, notify affected parties, recover data, and review security controls.
• B. Contain the incident, notify affected parties.
• C. Recover data, contain the incident, and notify affected parties.
• D. Review security controls and notify affected parties.

Answer: (A)

When a data destruction incident is detected, the priority is to stop the damage first. Containing the incident limits further data loss and buys time to understand what happened. Once the incident is contained, informing affected borrowers is essential to meet regulatory obligations and maintain trust, giving them timely notice about potential impact. After containment and notification, the focus shifts to recovery—restoring data from backups, verifying integrity, and getting systems back to normal operation. Finally, reviewing and improving security controls addresses the root weaknesses that allowed the destruction to occur and helps prevent recurrence.

Starting with recovery before containment risks more data loss and undermines the accuracy of restoration. Skipping containment or notification, or delaying recovery and control improvements, leaves harm unresolved and risk higher in the future.