Explanation:

• Forensic Expenses: You have determined that data has been compromised and need to investigate what happened, how it happened, and what information was accessed. The expenses to hire an outside forensic team for discovery is covered.
• Legal Expenses: You will need legal representation in order to determine the scope of the federal and state notification requirement breaches. You will also need legal counsel to defend you in the event a suit is filed against you.
• Notification Expenses: These expenses can include postage, paper, printing, call centers, etc.
• Credit Monitoring and ID Theft Repair: While not legally required, it is generally agreed that offering these services to the affected parties will reduce potential legal liability and is considered the right thing to do.
• Public Relations Expenses: The manner in which the breach is reported to the media is crucial to restoring your reputation and maintaining your clients, vendors, business associates, partners, and patients.
• Liability and Defense Costs: It’s not uncommon for class action lawsuits to be filed against you following a breach. You will need legal representation which can be of your own choice or appointed by the carrier. Either way, coverage is available for these costs.

Hence option 2nd is correct.