One does not. Instead a root cause analysis is performed and best effort mitigating measures and monitoring measures are put in place to satisfy auditors, investigators, independent third party security analysts and optional insurers.