What steps should a company take after discovering a data breach?

• A. Activate the incident response plan, notify affected individuals as required, and comply with applicable breach reporting laws and regulatory obligations.
• B. Immediately shut down all systems permanently and discontinue breach investigations.
• C. Publicly disclose the breach with a press release before notifying affected individuals.
• D. Wait for regulators to contact the company before taking any action.

Answer: (A)

The key idea being tested is how to respond to a data breach in a responsible and legally compliant way. When a breach is discovered, the first move is to activate the incident response plan. This sets in motion containment, investigation, and coordination with legal, security, and communications teams to limit further damage and preserve evidence. After containment and assessment, you must notify affected individuals as required by law, since timely notification helps people protect themselves from identity theft and enables them to take protective steps. At the same time, you need to comply with applicable breach reporting laws and regulatory obligations, which may include reporting to regulators, state authorities, or sector-specific bodies and meeting defined timelines.

This approach balances immediate containment with legal duties and consumer protection. Other options derail the process: shutting down all systems permanently is an excessive, impractical response that halts necessary investigation and recovery; public disclosure before notifying those affected can create confusion and may violate notification requirements; and waiting for regulators to initiate contact before acting delays remediation and increases risk.