Which action is considered best practice when you suspect a data-breach within BCC networks?

• A. Isolate affected systems, preserve evidence, notify security, and follow cyber incident response plan.
• B. Continue operations and ignore the alert.
• C. Shut down all systems permanently.
• D. Publicly accuse a third party without evidence.

Answer: (A)

When you suspect a data breach in BCC networks, the priority is to act in a coordinated incident response manner. The best practice is to contain the incident by isolating the affected systems to prevent further access and lateral movement, while preserving evidence so investigators can determine what happened and how to fix it. This means keeping logs intact, collecting relevant data, and maintaining a clear chain of custody, rather than wiping or altering anything that could be part of the forensic record.

At the same time, notify the appropriate security responders so they can triage and lead the investigation. Early involvement of the security team helps ensure containment, eradication of the threat, and a structured recovery, all aligned with the organization's incident response plan. Following the plan provides defined roles, steps, and communication channels, which helps maintain control, minimize downtime, and capture lessons learned for future improvements.

The other options don’t fit because continuing operations in the face of a suspected breach can allow the attacker to do more damage. Shutting down all systems permanently is impractical and destructive, not a measured incident response. Publicly accusing a third party without evidence is inappropriate and risks wrongfully damaging reputations and triggering unnecessary legal or diplomatic issues.