Which sequence reflects common regulatory expectations for responding to a data breach?

• A. Confirm incident, contain, preserve evidence, assess impact, notify authorities and affected individuals as required, and document timeline.
• B. Ignore the incident until legal review.
• C. Notify only internal teams; no evidence preservation.
• D. Delete all data to prevent further exposure.

Answer: (A)