Place the following initial discovery steps in the correct chronological order when responding to a suspected payment card data incident: 1. Assess the applicable compliance context and document the response. 2. Recognize the report of unauthorized customer charges as the triggering event. 3. Identify payment-processing systems and determine whether cardholder data is stored.

### The order 1. **Recognize the client's report of unauthorized charges as the trigger event.** The report is the scenario's initial signal that an incident may have occurred. 2. **Identify the payment-processing systems and determine whether cardholder data is stored.** Participants need to establish what systems and information may be involved. 3. **Assess the compliance context and document the response.** With the initial scope considered, participants assess compliance and record processes and actions. ### The concept Discovery starts by recognizing the reported event, then establishes which systems and data may be affected. The exercise specifically asks participants to verify whether the firm stores cardholder data and to select the appropriate Self-Assessment Questionnaire (SAQ). Documentation supports an organized response and later review. This sequence does not establish that the report is accurate or that the firm itself stored the data; those are matters to verify. ### Terms - **Self-Assessment Questionnaire (SAQ)**: A questionnaire used in the exercise to assess the firm's applicable payment-card compliance context. - **Cardholder data**: Payment-card information whose storage and handling the participants must determine. ### Watch out Do not assume that the firm stores cardholder data just because it uses a cloud billing platform; the exercise says to verify this. ### Remember First identify the reported event, then establish systems and data, then document and assess.