This year, there were several reports of thieves hacking into online credit card processing systems and stealing hundreds of credit card numbers belonging to customers of various companies.

With these thefts, a practice that is commonplace across industries, online credit card processing, suddenly has become an avenue through which customers' data was compromised.

Online credit card processing is but one of the ways many companies are exposed to potential cybercrime. Before adding any electronic system, every business should take time to identify the potential data risks, assess how the business would be impacted if confidential data were lost, stolen or no longer accessible, and then determine a strategy for managing those data risks.

In identifying potential data risks, business executives should itemize all the ways the company's confidential data is transported and stored. Most companies use several methods, including electronic backup systems, off-site storage facilities, portable storage devices, as well as the hot new trend of cloud computing.

Business owners should take time to assess their risk levels by considering:

• Does your company conduct business or sales transactions via the Internet?

• Does your company accept credit card payments online or through swiping terminals?

• Do employees send you proprietary or confidential information via email or file-sharing sites?

• Does your company access computer applications that are stored remotely?

• Does your company store data on offsite computer servers?

• Do employees use laptops, PDAs, flash drives, smartphones or other instruments outside the office that are not encrypted?

The next step is to assess how vulnerable the company is to having those methods compromised by internal and external activities, as well as how the company would be impacted by a breach.

The most common online security breaches occur because of common human error and the failure of employees to follow company security policies. If private or confidential data is compromised, a company can experience significant expenditures, which include the costs associated with notifying potentially affected people, securing the compromised data, public relations efforts to minimize reputational risk and any associated damage caused to those affected by the breach.

Moreover, the 9th U.S. Circuit Court of Appeals has ruled that evidence of a data breach equates to damage — even if the information is not misused — thereby potentially making it easier to successfully sue.

Once a business has identified its data risks and potential losses, it is time to develop a strategy to manage those risks.

Both in-house and outsourced security personnel need to be involved in deciding how to shore up the company's physical security, network security and employee training. That should include a process for vetting IT vendors.

They also need to plan for reporting any breaches, isolating compromised systems, recovering data that is lost or stolen, and funding any liabilities.

New Cyber Liability and Data Protection insurance policies can help minimize financial losses by assisting with the costs of notifications, reconstructing any data that was stolen or removed and securing systems against future attacks. The policies also cover lawsuits brought against a company for breach of private, personally identifiable information.

Marla Rhodes is a consultant in the corporate risk management division of Business Financial Group.