EN
Companies of all sizes often make prevention their sole focus when in reality, it’s not a matter of if your company will be impacted by a cyber security incident, but when. Mitigating a cyber crisis often comes down to properly managing a cyber incident before, during, and after it unfolds. This starts with a broad view of cyber crisis management and effective planning. Creating a cyber security plan for your business is the first step you can take to help mitigate your cyber risk. While there isn’t one plan that will work for every business there are basic security principles that any business can follow, regardless of size.
Building a Cyber Security Crisis Plan
The single most important factor in being able to successfully manage a cyber security crisis is having a plan in place. Planning for a crisis may seem defeatist, but in an evolving digital environment, planning for one is simply another part of having a strong risk management and incident response strategy.
You can enlist your security firm and/or any cyber security personnel within your company to help develop and test the plan, but it must be developed in partnership with the executive and business teams, as cyber security crises are, at their core, a business problem.
A good cyber security crisis plan will have these essential components:
A crisis management team
We often think of cyber as the domain of IT employees, but you’ll need a broad selection of skillsets to manage the crisis. Depending on the size of your company, the team may include representation from IT, legal, communications, and operations.
Plans tailored to a variety possible scenarios
Once you’ve identified the most pressing risks, make a plan for each, and identify the capabilities you’ll need to manage them. If you don’t have a capability in house, consider how you’ll develop it or bring it in in the event of a crisis.
A detailed communication plan
Figure out which stakeholders needs to be notified at which stage, and how. Stakeholders include clients, investors, and partners, and you’ll also need to determine how you’ll capture and share information with law enforcement and regulatory agencies, if applicable. From a reputational standpoint, regular and transparent communication will allow you to control the narrative and avoid speculation.
A regular review cycle
The cyber crime landscape evolves on a daily basis, and with it the types of threats that your business could face. Therefore, your plan should be regularly revised to incorporate any emerging threats, and it should also be tested regularly to ensure that the plan remains feasible.
A client-first approach
Protecting the client should be a priority reflected in your cyber security crisis plan. This means planning for proactive, frequent, and transparent communication with clients about what happened and how it affects them, and responding to inquiries in a timely and accurate manner.
Getting Started
To help you, we have developed a Cyber Security Crisis Management Template, which you can download here. The information provided will help your business prepare in advance of a crisis, mitigate certain risks, and shorten the length of time it takes to get back on track.
Cyber is just one more risk that businesses need to manage in order to ensure that a cyber security crisis doesn’t catch them unprepared. Having a crisis plan in place can mitigate the impact from a legal and reputational standpoint, allow you to act quickly, and ultimately protect your client relationships.
October 21, 2019
Share
