Richard Blumberg, director of data breach response services at Equifax; Gary Kibel, partner at Davis & Gilbert LLP

A prudent firm should not wait until a clear and direct obligation exists before taking steps to secure its systems and processes.