During incident response, which approach helps protect privacy and limit data exposure?

During incident response, which approach helps protect privacy and limit data exposure?

• A. Limiting data collection to what is necessary for the response.
• B. Collecting every log from all systems.
• C. Posting data publicly for transparency.
• D. Storing data in unencrypted form.

Answer: (A)

Data minimization is the key in incident response. By collecting only what is necessary to understand, contain, and recover from the incident, you limit the amount of sensitive information that could be exposed or misused. This reduces privacy risks, lowers the data you have to secure, and speeds up the investigation because you’re focusing on the relevant signals and time frame. In practice, you scope data collection to impacted systems and the essential data types needed to establish what happened, the timeline, and the extent of the impact, while redacting or omitting unnecessary personal data when possible and keeping retention and access controls tight. Collecting every log from all systems would over-collect data, increasing privacy risk and storage burden. Posting data publicly would violate confidentiality and privacy protections. Storing data unencrypted dramatically raises the risk if a breach occurs.

Data minimization is the key in incident response. By collecting only what is necessary to understand, contain, and recover from the incident, you limit the amount of sensitive information that could be exposed or misused. This reduces privacy risks, lowers the data you have to secure, and speeds up the investigation because you’re focusing on the relevant signals and time frame. In practice, you scope data collection to impacted systems and the essential data types needed to establish what happened, the timeline, and the extent of the impact, while redacting or omitting unnecessary personal data when possible and keeping retention and access controls tight.

Collecting every log from all systems would over-collect data, increasing privacy risk and storage burden. Posting data publicly would violate confidentiality and privacy protections. Storing data unencrypted dramatically raises the risk if a breach occurs.