I highly recommend doing drills with various scenarios such as an actual breach that you know to have resulted in lost data; a suspected, but unconfirmed, disclosure of data; and the loss of data by a partner (as happened with customers of Epsilon).

Doing test-drives helps you understand who out of the organization has to be involved, what their roles are, and how quickly you can get in contact with your customers. It also gives CFOs an idea of what each scenario could cost the organization. If you ever doubt the impact of a possible loss, just remember that the surrounding the loss of an agency laptop that could have exposed clients to identity theft.

This could be you.