After a security breach, what must an organization do to comply with FACT Act requirements?

• A. Only file a report with regulators.
• B. Provide free credit monitoring to all consumers.
• C. Post a public notice without individualized notices.
• D. Notify affected individuals and take steps to secure data and mitigate risk.

Answer: (D)

After a security breach, you must notify affected individuals and take steps to secure the data and mitigate risk. This direct notice gives people the information they need to protect themselves, plus it prompts the organization to fix vulnerabilities and reduce the chance of further harm, such as by tightening security and monitoring for misuse. It’s not enough to file a report with regulators alone, nor is it required to provide free credit monitoring to everyone, and posting a public notice without individualized notices doesn’t meet the consumer-focused protection purpose. The responsible approach centers on informing those affected and actively reducing ongoing risk.