Key actions in the bulletin
Treat sensitive data as an asset: understand what is collected, where it is held and who can access it. Control access, use strong authentication, maintain system updates and protect data when stored or transmitted.
Train employees to identify suspicious messages and handle information responsibly. Prepare a breach-response process covering containment, assessment, recovery and accurate communications, including any legally required reporting. Keep tested backups separate from the systems they protect.