Federal laws also impose data security and, in some cases, breach notification requirements on certain regulated industries including the nuclear energy industry; the maritime, aeronautical, and rail transportation industry; the chemical manufacturing industry; the telecommunications industry and any industry that may bring companies into contact with national defense information. Violations of these provisions can result in regulatory investigation, civil penalty, loss of government contracts and, in certain cases, criminal prosecution.

Nearly all 50 states have adopted breach notification laws requiring companies to notify individuals whose personal identifying information may have been exposed as the result of a network intrusion. State consumer protection laws also often offer a cause of action for litigants who allege harm resulting from a network intrusion.

Many contracts with vendors, customers or affiliates include data security or confidentiality clauses. Your company should review your contracts to determine which may potentially expose you to litigation and whether your company can take steps to mitigate this risk. Finally, common law theories such as implied contract, negligence and breach of fiduciary duty may also present a risk of litigation.

A company that suffers a network intrusion also must consider the risk the intrusion poses to its ongoing business. Increasingly, proprietary technology, information and other intellectual property are a company's most valuable assets. Companies may therefore suffer staggering commercial loss if, as the result of an intrusion, market competitors gain access to such technology and information. In such cases, companies should consider accelerating patent applications associated with such intellectual property and monitoring published patent applications for a period following the intrusion to detect any applications that appear to be based on information misappropriated during the intrusion. A similar strategy can be employed to protect trade secrets.

Reputational harm, though often hard to quantify, can pose the greatest threat to a company. Simply put, if your company's customers and business partners do not perceive your network to be secure, they may not want to entrust your company with their sensitive data. A victim company should assume that a breach will become public and prepare a communications strategy that addresses each of its important relationships and constituencies. Your company should prepare a communications strategy before it suffers an intrusion and should update the strategy as investigation of the intrusion and remediation of the network continue.