You must have a written plan that details the company's response and recovery to any event that results in damage to or destruction of books and records or a data breach. The plan must be maintained as part of your books and records.
Wash. Admin. Code § 208-690-280