Which measure should be included in a data breach response plan?

• A. Limit the number of staff involved.
• B. Conduct routine security training.
• C. Create a data breach response plan.
• D. Ignore encryption during incidents.

Answer: (C)

Having a formal, documented process for how to respond to a data breach is essential. A data breach response plan defines who does what, in what order, and by when, covering detection, containment, eradication, recovery, and communication with stakeholders and regulators. This plan provides clear roles, escalation paths, notification timelines, and steps to preserve evidence, so responses are fast, coordinated, and compliant. Without such a plan, actions can be ad hoc, leading to delays, inconsistent messaging, and greater risk of legal or regulatory penalties.

Limiting staff involvement would hinder coordination, since the plan should specify the right people and responsibilities rather than reduce participation. Security training is important for prevention and preparedness, but it isn’t the measure that the plan itself must include. Ignoring encryption during incidents would undermine data protection and complicate investigations, so it’s not a correct practice.