Which action should you take when documenting a data breach incident?

• A. Only record the date.
• B. Document incident details, actions taken, and outcomes.
• C. Delete the record after three days.
• D. Share all notes publicly.

Answer: (B)

Documenting a data breach requires a complete, traceable record that shows what happened, what was done in response, and what happened as a result. This kind of thorough documentation creates an auditable timeline you can reference during investigations, regulatory inquiries, and post-incident reviews.

Think about including details such as when the breach was detected, which systems and data were affected, who or what was involved, and the sequence of events. Record the containment actions (how the breach was stopped or isolated), eradication steps (removing the threat), and recovery status (restoring services, validating that systems are clean). Note what notifications were made to stakeholders or regulators, along with any approvals or decisions made, and who performed each action. Finally, document the outcomes and any lessons learned or follow-up remediation plans.

Keep these notes secure and accessible only to authorized personnel, and retain them according to your organization’s policies. Do not make notes public.

Choosing to document only the date, deleting the record after a short period, or sharing all notes publicly would leave you without essential evidence, undermine accountability, and risk privacy and security violations.