What should be the initial action when a data breach is suspected?

• A. Follow the Incident Response Plan, report to a supervisor, and preserve evidence and logs
• B. Immediately shut down all operations and surrender
• C. Publicize the breach in an official press release
• D. Do nothing until it becomes obvious

Answer: (A)

When a data breach is suspected, the first action is to follow the Incident Response Plan, report to a supervisor, and preserve evidence and logs. This approach gets trained responders moving quickly, establishes a structured path through containment, investigation, and recovery, and ensures that every step is documented. Preserving evidence and logs is crucial for an accurate reconstruction of what happened, how it happened, and which systems or data were affected, while maintaining the integrity of potential legal or regulatory proceedings.

Reporting to a supervisor ensures proper escalation and coordination across security, IT, legal, and management, so resources are mobilized and decisions are made consistently. This disciplined, documented start minimizes further damage, supports a traceable investigation, and helps meet any mandatory breach notification requirements.

Avoid delaying action or taking drastic, unplanned steps. Shutting down operations without guidance can cause unnecessary disruption and may not effectively contain the breach. Publicizing the breach prematurely can harm customers and stakeholders and may violate policy or law. Doing nothing allows the breach to worsen and increases risk to data and systems.