An information security manager has identified the loss of confidentiality of personal information. Which of the following should be done NEXT?

The correct answer is C. Initiate the incident response process. Loss of confidentiality of personal information is a security incident. The next step is to initiate the incident response process so the organization can contain, investigate, assess impact, and meet any breach notification obligations in a controlled, timely manner.

Submitted by certguy· Apr 18, 2026Information Security Incident Management

Question

Options

AInform the data protection officer (DPO).
BPerform an organization-wide risk assessment.
CInitiate the incident response process.
DReport the issue to senior management

How the community answered

(33 responses)

A
3% (1)
B
9% (3)
C
82% (27)
D
6% (2)

Explanation

Loss of confidentiality of personal information is a security incident. The next step is to initiate the incident response process so the organization can contain, investigate, assess impact, and meet any breach notification obligations in a controlled, timely manner.

Topics

#Incident Response#Incident Identification#Data Breach#Confidentiality

Community Discussion

No community discussion yet for this question.

Full CISM Practice