Responding to an incident quickly is important, but it shouldn’t come at the expense of reporting it to the appropriate regulatory bodies.