Yeah so they sued the commission over data collection.
They need avoid data. They need to go after processes and controls. Get the controls in place for the next one. And use professional auditors to help identify the weaknesses and to suggest controls.
Using an outside agency is crucial.