for following up to ensure the threats and vulnerabilities are gone (such as virus scanning, port scanning, vulnerability testing and network analysis) Procedures for communicating with external parties such as customers, business partners and the media (this may be one of the first things your organization is required to do!) Requirements for retaining records related to security breaches