Initially, the SSN within the response should be checked to ensure its
validity, as it is possible that the regular expression has matched a
similar number with no relation to a real SSN.

If the response does
contain a valid SSN, then all efforts should be taken to remove or
further protect this information. This can be achieved by removing the
SSN altogether or by masking the number so that only the last few
digits are present within the response (eg. _**********123_).