A data discovery scan finds customer identity records in a departmental file share that is not listed in the information asset inventory and has broad access permissions. There is no evidence that the data has been accessed improperly. What should the information security manager do?
Select an answer to reveal the explanation.
Short Explanation
Finding valuables in an unlocked closet means you lock it, tag it and figure out whose it is. You bring the share under management with an owner and proper controls, rather than shredding the contents or calling the regulator before you know there's a breach.
Full Explanation
Discovery of sensitive data in an unmanaged location reveals a gap in the inventory and an unassessed exposure. The appropriate response is to bring the data under management: record the share in the asset inventory, identify the business owner who is accountable for it, have the data classified, and apply controls such as restricted access consistent with that classification. The owner can then decide whether the data should be migrated to an approved system or disposed of according to retention requirements. Deleting the records immediately could destroy data the business needs or is legally required to keep, and it removes evidence of how the data came to be there. Notifying a regulator presumes a breach that has not been established; the finding is an exposure, and notification decisions follow investigation and legal advice according to applicable requirements. Rescanning next month leaves sensitive data broadly accessible for another month with no owner and no protection. Exam caveat: if the investigation later finds evidence of improper access, incident response and notification procedures apply. Operational check: confirm the share now appears in the inventory with a named owner, that access is restricted to authorized roles, and that discovery scans are scheduled to find other unmanaged locations.