How should a data breach risk affecting Mega Goal metrics be handled?

• A. Notify stakeholders only
• B. Ignore the incident if data is encrypted
• C. Postpone action until after project completion
• D. Activate incident response, containment, notification, remediation, and review controls

Answer: (D)

The main idea here is that a data breach requires a formal incident response process that covers not just stopping the breach but also communicating with stakeholders, fixing the underlying issues, and learning from the event to strengthen controls. Activating the incident response, containing the breach to prevent further data loss, notifying the right parties, remediating vulnerabilities or compromised systems, and reviewing controls afterwards gives a complete, proactive response that protects Mega Goal metrics and governance going forward. Merely notifying stakeholders without containment can let the breach continue; ignoring it even if data is encrypted may leave gaps in response and assurance; postponing action until project completion avoids timely protection and accountability. The comprehensive approach is the most effective and responsible path.