Following a data breach involving client information, which set of actions should a CFP professional take?

• A. Notify affected clients, mitigate harm, document incident, and review security controls.
• B. Notify authorities only.
• C. Review security controls only.
• D. Mitigate harm only.

Answer: (A)

Handling a data breach is about protecting client information and maintaining trust. The best approach includes taking steps to limit harm, communicating promptly with those affected, and creating a record of what happened while strengthening defenses for the future.

Notifying affected clients is essential so they can take protective actions, monitor for potential misuse, and understand their exposure. Mitigating harm involves immediate actions to reduce risk and remediate any damage, such as offering credit monitoring or other assistance to minimize ongoing risk. Documenting the incident creates a clear, auditable record of what occurred and what was done in response, which supports accountability and learning. Reviewing and strengthening security controls after the incident helps prevent similar breaches in the future and demonstrates a commitment to safeguarding client information.

Other options miss one or more of these critical steps—either leaving out client notification, remediation, documentation, or the post-incident review of controls—so they don’t provide a complete, responsible response.