Security breaches must be communicated to management immediately, even if the details of the breach are not yet fully understood. The consequences of the breach must be made clear and management must take steps to control the situation from all perspectives.