BotanéBloom experienced a data breach after an intern accidentally exposed a private administrative key on...

ISO/IEC 27001:2022 classifies controls by their function: corrective (remediate after an incident), preventive (prevent future occurrences), and detective (identify/detect events). Applying this framework to the three actions: (1) Changing all system access credentials after the breach = Corrective control — it addresses and limits the damage caused by the existing incident; (2) Updating onboarding procedures for interns = Preventive control — it prevents a similar incident from happening in the future; (3) Implementing log analysis for account activity = Detective control — it enables future detection of suspicious activity. Therefore, the correct sequence is Corrective → Preventive → Detective, matching Option B. This ordering reflects the natural post-incident response lifecycle: fix the immediate problem, prevent recurrence, then monitor for future issues.

================