An organization determined that an unauthorized person gained access to their files that contained protected health information $($PHI$).$ Once the organization became aware of the unauthorized access, it contacted a cybersecurity firm. What administrative requirement does this step fall under?