In a data breach response, what is the initial step?

• A. Assess the impact
• B. Notify affected parties and authorities
• C. Contain the breach
• D. Remediate controls

Answer: (C)

The main idea being tested is that stopping the spread of a breach is the immediate priority. Containing the breach means quickly isolating affected systems, cutting off attacker access, and blocking further data exfiltration. This step is crucial because it limits damage, preserves evidence for later investigation, and prevents the attacker from gaining more footholds in the environment.

Once containment is in place, you can accurately assess the impact—understanding exactly what data was exposed, which systems were affected, and how long the breach was ongoing. This information guides what needs to be notified and what remediation is required.

Notification of affected parties and authorities, while essential, typically follows containment and initial assessment, so you’re not providing false or incomplete information and you can meet any legal timing requirements with a clear, accurate scope. Remediation of controls comes after containment and eradication are underway, to restore security and prevent recurrence.