"Breach notification planning is just a fundamental, basic part of risk management in the new millennium," says security expert Bob Chaput.