[CentOS] What to do when you've been hacked?

No, we haven't been hacked. ;) We have a prospective client who is asking us what our policy is in the event of unauthorized access. Obviously you fix the system(s) that have been compromised, but what steps do you take to mitigate the effects of a breach? What is industry best practice? So far, searches haven't produced anything that looks consistent, except maybe identity monitoring for financial data. (EG: Target breach) We host a significant amount of educational data, but no financial information. How would we even respond to this question? I've also posted this question at https://www.reddit.com/r/linuxadmin/comments/42mi1r/what_to_do_when_youve_be... Thanks, Ben