Sample question 1 — Incident Management
A breach at Wharfedale Retail affecting customer payment data was confirmed at eleven o'clock on a Friday. The security team has contained the incident, and the legal team is still debating whether the notification deadline applies. Which action should the chief information security officer take?
- A. Start the regulatory notification clock and prepare advice.
- B. Wait for legal certainty before contacting any regulator.
- C. Notify affected customers first and inform regulators afterwards.
- D. Delay notification until the forensic investigation is complete.
Answer: A. Option A is correct because a decision to start the regulatory notification clock and prepare advice within it reflects the fact that the duty runs from awareness of the incident, so the assessment must be prepared inside the window. Waiting for legal certainty in Option B risks the deadline passing, and delaying until forensics conclude in Option D can extend well beyond the permitted period. Contacting customers before the regulator in Option C may misstate the position if obligations differ by jurisdiction.