What is a Cyber Incident Response Plan, and Why Does My Business Need One?
September 19, 2023
Courtesy of SBAM Approved Partner, SensCy
Every business owner would agree that the time to plan your response to a cyberattack is not in the middle of the incident. Research from the University of Georgia shows that a cyberattack occurs every 39 seconds, and 43% of these attacks target small businesses. Despite these statistics, not even a third of SMOs have a cyber incident response plan in place, according to SensCy Score data.
What is a Cyber Incident Response Plan?
A cyber incident response plan is a written document that guides your organization before, during, and after a cybersecurity incident. It provides a roadmap of actions and responsibilities necessary to ensure your organization can recover efficiently from a cyberattack.
Why are Cyber Incident Response Plans Important?
To begin, an efficient response translates to an efficient recovery.
Responding timely to a cyberattack can prevent the attack from spreading through your organization and causing more damage. A cyber incident response plan provides a step-by-step roadmap that identifies activities and authority necessary to quickly mitigate the damage caused by a cyberattack.
Business owners and team leadership therefore must be involved in the development of the plan and sign off on its execution. Key personnel need to be assigned to response roles in advance and must be given the authority to make early decisions during an incident.
An organization’s cyber incident response plan prevents a situation where the information technology (IT) personnel notice an incident but must wait to receive permission from someone in senior leadership before they begin to shut down systems. Having a documented and tested plan in place ahead of an attack eliminates the time required to track down a senior decision-maker. A response plan could therefore end up saving the business thousands to millions of dollars in recovery costs, depending on the severity of the attack.
3 Tips and Reminders for Your Organization’s Cyber Incident Response Plan
- Prepare questions for business leaders to ask during and after an incident.
Since most business owners are not cybersecurity experts, information about a cyber incident they experience may be difficult to understand. A good cyber incident response plan will empower business owners and leaders with a list of questions to ask to better understand the cyberattack, the recovery process, and the timing of communications. - Internal communications – How will we manage this crisis?
As your systems begin to go down, whether caused by the cyberattack itself or by your business shutting them down to prevent spread of the attack, your organization’s internal communication tools – like email, messaging apps (such as Slack and Teams), and video conferencing capabilities – will also be shut down.
A crisis like a cyberattack requires an all-hands on deck approach and constant communication between various parts of the business. The time to plan for alternative forms of communication is not during the crisis. Alternative communication plans must be spelled out in a cyber incident response plan prior to an attack so that your organization can seamlessly pivot to alternative methods of communication and manage the incident appropriately.
- External communications – What do we say to our customers, employees, and suppliers?
All external stakeholders can be impacted if your business experiences a cyberattack. Much like an internal communication plan, the plan for how to communicate this incident to various stakeholders must be established in advance. Employees, vendors, partners, and suppliers are all potential victims of a cyberattack on your business. It is essential to prepare communications with them to mitigate unhealthy speculation that can lead to further reputational risk.
A good cyber incident response plan will include communication templates and recommendations on what to say to each of our stakeholders throughout the cyberattack and recovery process. It is best practice to have these communications reviewed by a legal professional during the creation of the cyber incident response plan and verified by the business owner or leadership team before you experience any business disruption caused by a cyberattack.
Final Thoughts
In conclusion, every SMO should have a cyber incident response plan. Every business owner or leader should ensure that employees understand the plan and are ready to deploy it in the event of a cyberattack.
If you would like additional information on what should be included in a cyber incident response plan, visit sbam.org/senscy to learn more.