You have been asked to review how well your company is prepared for a major data breach of your firm’s customer database containing some 15 million records with names, addresses, passwords, credit card numbers, and payment history. The goal is to minimize the potential impact of a hacker getting access to this data and to avoid expensive class action lawsuits from affected customers. How would you proceed with this audit? What sort of measures would you look for or recommend?