"[B]efore an incident even occurs, plan sponsors should speak with their vendors about having an incident response plan, which is typically a written document, formally approved by an organization's senior leadership team, that helps the organization mitigate risk before, during and after a security incident.... Once the problem is contained and steps have been taken to mitigate the breach, a sponsor needs to have a plan for how the organization will communicate the issue with its participant base."

MORE >>