ity, these incidents and the 
recovery actions and their results must be reported to administrators and made available to all 
relevant staff. Given identification of the sources of data loss, an assessment of revisions to 
software and hardware systems, or operational procedures, or management policies is needed 
to minimize future risk of data loss. 
5.1.1.4 The repository shall have a process to record and react to the availability of 
new security updates based on a risk-benefit assessment. 
Supporting 