Once a breach occurs the Controller must seek to contain the incident and asses the risk.