The correct answer is D . Exposure of a significant number of personal customer records may create serious legal, regulatory, financial, and reputational impact. Senior management must be informed so they can make risk treatment, notification, legal, and resource decisions. The uploaded CRISC notes state that when a significant vulnerability is discovered in a critical system, the system owner should be notified to take corrective action. They also state that newly discovered risk should be communicated to decision makers and relevant stakeholders at the end of the risk assessment phase.

B would be correct if an actual incident or breach is confirmed. C should happen, but after escalation. A is too slow and indirect for significant personal-data exposure.