Uh-oh, Sales has lost a laptop. <A HREF="http://www.eweek.com/article2/0,1895,2105506,00.asp?kc=EWNAVEMNL032007EOAD">The nightmare that ensues brings a host of uncertainties:</A> Exactly what data was on that thing? How do you define nonpublic, private or confidential information? What constitutes a breach or a mass data compromise? What are your obligations to protect that data, and what are your organization's obligations regarding notifying the potential victims of identity theft?

These are just some of the questions you should answer before the laptop is lost, the BlackBerry is stolen or the database is hacked, said Mark Everist, a director of audit for American Express, during a session titled "Ensuring Customer Notification of Unauthorized Access" at the InfoSec World Conference & Expo.