D imo makes sense if the focus was on fixing payments quickly, but since it's asking what to do first, A fits better because you need to figure out what happened before jumping to manual fixes. Is there a specific company policy that prioritizes incident escalation over initial investigation?
Shouldn't we clarify exactly what caused the payment misdirection before alerting IR? If the SaaS tool was down and it's not confirmed as a breach, jumping straight to B seems premature. Anyone else think gathering info from the SaaS team (A) makes more sense as a first step?
Shouldn't we check with the SaaS tool team first to figure out what went wrong before escalating? Jumping to B seems like an easy trap here, since you don’t know the scope or if it’s a breach yet.
