In case of a data breach, who should be notified first?

• A. Notify customers first.
• B. IT security team should be notified first.
• C. Notify marketing team first.
• D. Do nothing.

Answer: (B)

When a data breach occurs, the immediate goal is to contain the incident and preserve evidence, so the first action is to alert the IT security team. They are equipped to rapidly identify what systems are affected, determine the scope of the breach, and start containment to prevent further data loss. They also collect and preserve logs and other forensic data needed to understand how the breach happened and to guide the response. Once the incident is being contained, IT security coordinates with legal or compliance to determine regulatory notification needs and with communications teams to inform stakeholders in a controlled way. Notifying customers before containment can cause premature exposure and confusion, and doing nothing is not a viable option.