Planning and procedures for responding to security incidents, including breach notification and damage mitigation.