One does not. Instead a root cause analysis is performed and best effort mitigating measures and monitoring measures are put in place to satisfy compliance teams, auditors, investigators, independent third party security analysts and insurers.

The internal compliance documentation policies must link to a procedure maintained within incident management for public disclosure. The next time an incident occurs the rough draft must be reviewed and signed off by the heads of public relations, legal, incident management, security engineering, operations and customer support.

Rinse and repeat until there is enough visibility into every layer of the platform to answer any question.