What are the steps in handling a data breach affecting client information?

• A. Contain the breach, assess scope, notify affected parties per policy, document, and remediate security controls.
• B. Ignore the breach to avoid alarm.
• C. Notify only internal staff, with no policy.
• D. Delay remediation until after audits.

Answer: (A)

Prompt, structured data-breach response starts with containment to stop the bleeding, then assess scope to understand who and what was affected, followed by notifying affected parties per policy (and applicable regulations) to inform them and meet legal obligations, then documenting the incident for auditability and lessons learned, and finally remediating security controls to close gaps and prevent recurrence. This sequence minimizes damage, satisfies commitments to clients and regulators, and strengthens defenses for the future. Ignoring the breach risks further exposure and potential legal trouble; notifying only internal staff with no policy leaves external stakeholders uninformed and can fail to meet regulatory requirements; delaying remediation until after audits means vulnerabilities remain open longer, increasing the chance of repeat incidents.