Which sequence describes the proper initial management of a suspected data breach?

• A. Monitor logs for 24 hours and then issue a public statement.
• B. Implement a full erase of all data immediately.
• C. Activate incident response, contain, assess impact, notify stakeholders, and remediate.
• D. Ignore for 72 hours to observe if events stop.

Answer: (C)

When a data breach is suspected, the proper initial management is to activate the incident response plan and quickly move through containment, impact assessment, stakeholder notification, and remediation. Activating the plan gets the right people involved and establishes a coordinated approach to stop further access, gather evidence, and thaw out the scope of the breach. Containing the breach minimizes additional data exposure and system compromise, while assessing impact determines exactly which systems and data were affected and what protections or disclosures are required. Notifying stakeholders—within legal, regulatory, and organizational obligations—ensures transparency and enables coordinated response, including law enforcement if needed. Remediation then addresses root causes, patches vulnerabilities, strengthens controls, and restores operations securely.

These other approaches miss essential steps or cause harm: monitoring logs for a day and then issuing a public statement is reactive and leaves containment and communication gaps unaddressed; erasing all data immediately is destructive and inappropriate as a first action; ignoring the breach for days allows ongoing damage and data loss.