Damage Control is pretty broad so I would actually have you categorize them more, for example ask:
What information does the company need to prevent a breach?
Ideally, nobody wants to be breached, or at a minimum we want our reaction time to be so good as to limit harm. This can be location based tracking, time of use tracking, habit tracking, standard Username/password w/ 2FA, device usage, policies etc.
This are things that a company does actively to:
- Warn of potential issues
- Interact with their customers securely
- Develop apps securely
What information does the company need to resolve the breach?
The adage of "it's not if but when something happens" is pretty prevalent. Once something occurs, what is the fastest way to resolve it? What are auditors, legal and/or law enforcement going to need or want?
This might be audit logs, transaction logs, location logs.
This really focuses on:
- Information to collect
- Information Security Response teams / policy
- Risk mitigation
How do you communicate with user?
The first two are straight forward, this one varies greatly since it's your direct interaction with users. This is really PR/company driven and the things you might think about are:
- What details are you willing to release?
- What is adequate compensation?
- What is regulated?
This last one honestly is not my forte. I personally want all the detail and feel the Who, What, When, Why, and How of a breach of should be fully communicated. I know plenty of people in the security community who don't feel this way, and certainly not my executive level who have to consider the entire company.
Above all, this is not an individual issue or even a single business units responsibility, you really need to drive it all levels.