Contain it and correct the immediate effects.
Find the root cause; check for similar issues.
Implement corrective action to prevent recurrence.
Confirm the action was effective.
Adjust the ISMS, risks and documentation.