When customer data has been compromised, an organization should contact law enforcement authorities:

A. if the attack comes from an international source.
B. when directed by the information security manager.
C. if there is potential impact to the organization.
D. in accordance with the corporate communication policy.