Which sequence best represents a typical DLP incident lifecycle?

Which sequence best represents a typical DLP incident lifecycle?

• A. Incident creation, triage, investigation, remediation action, evidence collection, approval, closure, and audit; progress tracked via case status, comments, and assignee.
• B. Incident creation, closure, audit, remediation, triage.
• C. Investigation, remediation, escalation, closure.
• D. Triage, incident creation, notification, archival.

Answer: (A)

In DLP, an incident lifecycle is an end-to-end workflow from detection to governance and review. The sequence starts with creating an incident when a potential data loss event is detected, then triage to determine urgency and scope. Investigation follows to gather facts about what happened, what data was affected, and who’s involved. Remediation action is then taken to stop the incident and apply the appropriate containment or policy-based response. Evidence collection preserves logs, artifacts, and records for forensics and regulatory needs. Approval brings in the necessary stakeholders to authorize remediation and ensure proper controls. Closure marks the incident as resolved and documents actions taken and outcomes. Finally, an audit captures the entire process for accountability, reporting, and ongoing improvement. Throughout, case status, comments, and assignee track progress and responsibility. The other options skip essential steps or place them out of order. They may omit triage, investigation, evidence collection, or governance steps like approval and audit, or they place closure before investigation or other critical activities, which doesn’t align with how a typical DLP incident is managed.

In DLP, an incident lifecycle is an end-to-end workflow from detection to governance and review. The sequence starts with creating an incident when a potential data loss event is detected, then triage to determine urgency and scope. Investigation follows to gather facts about what happened, what data was affected, and who’s involved. Remediation action is then taken to stop the incident and apply the appropriate containment or policy-based response. Evidence collection preserves logs, artifacts, and records for forensics and regulatory needs. Approval brings in the necessary stakeholders to authorize remediation and ensure proper controls. Closure marks the incident as resolved and documents actions taken and outcomes. Finally, an audit captures the entire process for accountability, reporting, and ongoing improvement. Throughout, case status, comments, and assignee track progress and responsibility.

The other options skip essential steps or place them out of order. They may omit triage, investigation, evidence collection, or governance steps like approval and audit, or they place closure before investigation or other critical activities, which doesn’t align with how a typical DLP incident is managed.