In a basic data breach response, which action typically occurs after containment and impact assessment?

In a basic data breach response, which action typically occurs after containment and impact assessment?

• A. Identify breach
• B. Contain breach
• C. Notify affected parties and authorities as required
• D. Document the breach

Answer: (C)

When you’re handling a basic data breach, the sequence moves from stopping the spread to understanding the scope, and then to telling those who need to know. After containment and impact assessment, notifying affected individuals and the appropriate authorities is the natural next step because you now have enough information to share what happened, what data was involved, and what actions people should take to protect themselves. This step is often required by law or regulation, so timely notification helps reduce risk to victims and demonstrates accountable incident management. Documentation and ongoing improvements should continue, but the formal act of notifying those impacted and the relevant authorities follows once you’ve contained the breach and assessed its impact.

When you’re handling a basic data breach, the sequence moves from stopping the spread to understanding the scope, and then to telling those who need to know. After containment and impact assessment, notifying affected individuals and the appropriate authorities is the natural next step because you now have enough information to share what happened, what data was involved, and what actions people should take to protect themselves. This step is often required by law or regulation, so timely notification helps reduce risk to victims and demonstrates accountable incident management. Documentation and ongoing improvements should continue, but the formal act of notifying those impacted and the relevant authorities follows once you’ve contained the breach and assessed its impact.