An organization that has outsourced its incident management capabilities just discovered a significant privacy breach by an unknown attacker. Which of the following is the MOST important action of the information security manager?

A. Follow the outsourcer’s response plan.
B. Alert the appropriate law enforcement authorities.
C. Refer to the organization’s response plan.
D. Notify the outsourcer of the privacy breach.