Your incident response team attempts to estimate the cost of a breach. The estimate is based on if the data records were customer and employee or employee only. Another factor is the scope of the breach, such as how many people were affected. Now that you know who and how much, what else do you need to know? What, Where, When, How Long