Which sequence reflects common regulatory expectations for responding to a data breach?

• A. Confirm incident, contain, preserve evidence, assess impact, notify authorities and affected individuals as required, and document timeline.
• B. Ignore the incident until legal review.
• C. Notify only internal teams; no evidence preservation.
• D. Delete all data to prevent further exposure.

Answer: (A)

Regulatory expectations for data breaches revolve around following a practiced incident response sequence that moves from quick confirmation to coordinated notification and accountability. Start by confirming the incident to avoid acting on a false alarm and to trigger the response process. Then contain the breach to stop further unauthorized access and limit damage. Preserve evidence so forensic analysis can proceed and regulators or investigators can review what happened, preserving the chain of custody. Assess the impact to determine what data was involved, which systems were affected, and who may be at risk. Based on that assessment, notify the appropriate authorities and the individuals affected as required by law or policy, and do so within mandated timelines. Throughout this process, document the timeline of events and actions taken to show due diligence and support any regulatory review.

Other approaches fall short because they delay or skip essential steps: ignoring the incident until legal review delays required reporting; notifying only internal teams and not preserving evidence prevents outside authorities and affected individuals from being informed and hampers investigations; deleting all data to prevent exposure is not a viable or compliant remedy and can obstruct both investigations and regulatory requirements.