Data breach response plan: initial steps for businesses