In the case of a breach, he said a company may want to contact the FBI or other authorities, depending on the type of loss.

With an accidental loss, government authorities may not need to be contacted unless directed by statute, as is the case in some states, he said.

Toby Merrill, vice president, ACE Professional Risk, said an important facet of a response plan is knowing how to respond before an incident occurs. This can save time, money and effort.

"But before you can determine how your company needs to respond to a breach, you will need to identify who in your company needs to be involved," he said.

Members of a response team, he said, would typically include senior level management from legal, compliance, information security, risk management, corporate communications and marketing.

Mr. Merrill added, "The next step is to establish a team leader to manage the crisis and direct operations."

This person, he said, would operate as the central contact for reporting status to senior management, and would oversee implementation of the plan.

A company should also identify the external expertise and resources that are needed. It's not unusual for organizations to tap experts in the marketplace for assistance with forensic, legal and public relations matters, he said, adding, "Therefore, it is important to pre-approve these vendors and add them to your incident response plan."

A solid plan should also identify someone to communicate with the media, Mr. Merrill said. A company may want to prepare for a breach by approving a third party communications or public relations firm with experience in responding to data breaches. This would provide backup to the company spokesperson, he observed.

Because there are many types of breaches that can occur, he said a company may want to consider storyboarding potential scenarios to help develop several contingency plans.

Mr. Merrill also recommended preparing written communications in advance. Letters to affected customers and business partners and other communications vehicles should be prepared so that the crisis response team can focus on giving the best response to a given breach, he said.