A data breach occurred which impacted the HR and payroll system. It is believed that an attack from within the organization resulted in the data breach. Which of the following should be performed…

Assessing system status is the initial triage step in incident response - it determines which systems are compromised, what data was accessed, and whether the attacker still has access. Without this assessment, any subsequent action such as restoration or investigation may be premature, incomplete, or counterproductive. This aligns with NIST SP 800-61 incident response guidance, which prioritizes detection and analysis before containment and eradication.

Restoring from backup tapes before assessing the breach could overwrite forensic evidence and is premature until the scope and nature of the compromise are understood.

A business impact analysis evaluates long-term effects and is a planning-phase activity, not the immediate first step during active incident response.

Reviewing NIDS logs is part of the investigation and analysis phase, but it is a component of the broader system status assessment rather than the overarching first action.