A practitioner in your office suspects, but does not know, that a cyber attack has potentially gained access to client information. Which of the following best describes the necessary actions to take?

a. Without full knowledge, there is nothing to be done, but the practitioner can voluntarily try to confirm their suspicions. Legally, there is not much else required at this point.

b. The practitioner should inform the individual or individuals in charge of the security of client data with all of the relevant information that they have to support their suspicion so these individual(s) can confirm and take the next necessary steps.

c. The practitioner should just go straight to law enforcement with the information, outside of the control structure of the organization they work for.

d. The practitioner should try to continue to allow the suspected breach to confirm and then afterwards contact the authorities with more proof than suspicion.