Actions to take after an attack - Crossword

Clues

1. Establish the type, severity and affected services after an attack. (11)
2. Inform stakeholders and authorities after a security incident. (7)
3. Contain a threat by isolating infected systems or blocking unauthorised network traffic. (6)
4. Follow a plan to restore systems and data after an attack. (7)
5. Review what went wrong and update policies and procedures. (7)
6. Employees, customers, suppliers and shareholders who must be told after a breach. (12)
7. Official bodies such as the police that must be told about a serious breach. (11)
8. Material from an attack that must be kept for a criminal investigation. (8)
9. Specific tasks given to named employees in a plan for restoring systems. (16)
10. Making devices more secure to reduce the chance of another attack. (9)
11. A company's public image, which may be harmed by telling customers about a breach. (10)
12. Financial penalties that can result from not reporting a breach to the authorities. (5)