What is an appropriate response to suspected access control violations?

• A. Publicly announce the breach without investigation
• B. Investigate, document, apply disciplinary actions per policy, and update controls to prevent recurrence.
• C. Ignore the incident and continue operations
• D. Immediately terminate the IT department

Answer: (B)

Handling suspected access control violations relies on a structured incident response mindset. The best course is to investigate to confirm whether a violation occurred, document what happened and what assets or access were affected, apply disciplinary actions per policy if wrongdoing is verified, and then update controls to prevent recurrence. This approach preserves evidence for any formal review, ensures accountability, and drives improvements in the security program to reduce the chance of similar events in the future. Broadcasting details publicly before facts are known can reveal sensitive information and hinder the investigation, while ignoring the incident leaves systems vulnerable and continuing risk. Taking extreme punitive actions, like terminating an entire department, is inappropriate and does not address the underlying issue.