A response team receives an extortion demand during a confirmed breach. What should guide the organization's decision process?

1. An assumption that payment removes reporting duties
2. The first analyst's personal preference alone
3. Authorized executive, legal, and specialist assessment of obligations, options, and consequences
4. A promise from the attacker as conclusive assurance