Which of the following would MOST likely be included in the incident response procedure after a security breach of customer PII?