[smileysteve]

Pull the plug.

The final "stick" and reason for a C in the title is the responsibility to shut down the data (and website) until such a point it can be secured.

It's should be considered more of a fiduciary duty (protect shareholders, customers) to protect data as making the right investment or HR decisions.

[tptacek]

"Pulling the plug" is almost never a capability provided to a company security team.

[tedunangst]

What happens when the CIO plugs it back in?

[smileysteve]

The CIO then accepts full liability.