A breach containment example showing how governance teams limit exposure, preserve evidence and document defensible notification decisions.