What steps should you take if you suspect a data security breach while handling an inquiry?

• A. Notify the security team and wait for guidance.
• B. Document yesterday's activities and continue processing inquiries.
• C. Immediately escalate to the supervisor, document events, preserve evidence, and follow the incident response plan.
• D. Ignore the issue unless there is a formal complaint.

Answer: (C)

When a data security breach is suspected, the immediate priority is to activate the incident response process: escalate without delay, document what you observed, preserve evidence, and follow the incident response plan. This approach ensures a coordinated, accountable response that can contain the incident, supports a proper forensic investigation, and keeps actions aligned with organizational policies and any legal or regulatory obligations. Escalating to a supervisor right away brings in the right people to trigger containment, notification, and recovery steps defined in the plan. Documenting events as they happen creates an accurate, traceable record of what occurred, when, and who was involved, which is essential for investigation and audits. Preserving evidence means avoiding changes to logs, files, or system states so investigators have a trustworthy basis to determine cause and scope. Following the incident response plan ensures standardized roles and communication, helping the team act efficiently and safely.

Delaying action by just notifying security and waiting for guidance can slow containment. Documenting only past activities and continuing processing risks losing relevant evidence and failing to address the breach promptly. Ignoring the issue until a formal complaint arises is unsafe and could allow the breach to worsen.