Which sequence reflects the appropriate order of actions in a data destruction incident affecting borrower data?

• A. Contain the incident and notify affected parties, then recover data.
• B. Notify affected parties, contain the incident, recover data, and review security controls.
• C. Contain the incident, notify affected parties, recover data, and review security controls.
• D. Contain the incident, notify affected parties, recover data, and review security controls.

Answer: (D)

The key idea is the incident response order that stops the damage first, then communicates, then restores, and finally strengthens defenses. Containing the incident immediately prevents further data exposure and damage. Once the spread is halted, you notify affected borrowers (and regulators as required) so impacted parties can take protective steps and you meet legal obligations. After notification, you work on recovering data and restoring normal operations, ensuring data integrity and system availability. Finally, you review and strengthen security controls to prevent a recurrence, using the lessons learned to update policies and defenses. Choosing this sequence keeps containment as the first priority, followed by timely communication, then restoration, and finally improvements to security.