After an information loss, which of the following three steps should be taken by an organization?

Following an information loss, a structured incident response is critical. The first logical step is to conduct an investigation to determine the nature, scope, and cause of the loss. Concurrently, the organization must conduct a damage assessment to understand the impact on business operations, finances, reputation, and legal obligations. This assessment informs the prioritization of response efforts. Finally, based on the findings of the investigation and the damage assessment, the organization will implement the recovery plan to restore the lost information, remediate vulnerabilities, and return to normal business operations. This sequence represents a standard, logical progression in incident management.

A. Implementing a business continuity plan is generally for major operational disruptions, not the specific response to information loss. Updating procedures is a post-incident, "lessons learned" activity.

B. Contacting law enforcement is a discretionary step dependent on the nature of the loss and organizational policy; it is not a mandatory initial action in all cases.

D. An inventory of proprietary information should be a pre-existing component of an asset management program, not something conducted after a loss has already occurred.

1. ASIS International

Protection of Assets (POA)

Security Management volume

2021. Chapter 5

"Information Security

" outlines the incident response lifecycle which includes identification/analysis (investigation and assessment)

containment

eradication

and recovery. The sequence in option C directly aligns with this established framework. The process begins with understanding the incident (investigation)

evaluating its impact (damage assessment)

and then moving to restoration (recovery).

2. Fischer

R. J.

Halibozek

E.

& Walters

D. C. (2019). Introduction to Security (10th ed.). Butterworth-Heinemann. Chapter 14

"Information Security

" discusses the critical steps in responding to a computer security incident. It emphasizes that after detection

an assessment or analysis of the extent of the compromise (damage assessment) is required to formulate a proper response and recovery strategy

which supports the sequence of investigation

assessment

and recovery.

3. National Institute of Standards and Technology (NIST). (2012). Computer Security Incident Handling Guide (Special Publication 800-61 Rev. 2). Section 3.2

"Incident Response Life Cycle

" details the phases of Detection & Analysis

Containment

Eradication & Recovery. The "Detection & Analysis" phase encompasses both the investigation and the assessment of damage

which must precede the "Eradication & Recovery" phase

where a recovery plan is implemented. This foundational document validates the logical flow presented in option C. (DOI: https://doi.org/10.6028/NIST.SP.800-61r2)