A customer credit card database has been breached by hackers. The FIRST step in dealing with this attack should be to:

A.
confirm the incident.

B.
notify senior management.

C.
start containment.

D.
notify law enforcement.

Explanation:
Asserting that the condition is a true security incident is the necessary first step in determining the correct response. The containment stage would follow. Notifying senior management and law enforcement could be part of the incident response process that takes place after confirming an incident.