An incident is contained but responders disagree whether regulated data left the environment. What is the best reporting approach?

1. Declare every customer record stolen without evidence
2. Declare no breach because the logs are incomplete
3. Separate confirmed facts, assessed possibilities, and evidence gaps
4. Delay all required internal escalation until certainty is perfect