Why Your Business Needs an Incident Response Plan

In today’s tech-driven world, where data breaches regularly break into headlines, every organization should have a cyber incident response plan. Unfortunately, too many companies fail to create — and practice — such plans. They may be seen as too costly, too time-consuming, or nonessential, but the ability to quickly respond to a data breach is essential.

What is an incident response plan?

Cybersecurity incidents, commonly known as data or security breaches, are events that compromise the integrity of your information assets, whether your own or your customers’ data, or disrupt your operations. An effective incident response plan can’t prevent a data breach, but it can prepare you to respond.

Some companies have no choice: regulations and standards such as Sarbanes-Oxley (SOX), the Federal Financial Institutions Examination Council (FFIEC) or the Payment Card Industry Data Security Standard (PCI DSS) may require a response. Required or not, every company should make a cyber incident response plan part of its emergency preparedness.

The uncomfortable truth is, data breaches are inevitable. The old adage, “it’s not a matter of if, but when,” still holds true. In a 2018 independent study, the Ponemon Institute estimated that 28% of organizations worldwide will experience a data breach within the next two years. Being able to respond in a way that minimizes damage to both finances and reputation is worth the cost.

What should a response plan include?

No single incident response plan suits everyone. When planning, first carefully analyze your operating environment. What threats are typical for your industry? What technological support do you have? What risks do you face? What are your financial constraints? Look at samples of existing frameworks and see how they could fit into your organization.

The National Institute of Standards and Technology’s Computer Security Incident Handling Guide outlines simple, yet thorough, incident response plan considerations.

Preparation

First, get the right stakeholders involved. The entire company should be on board, with a few key members taking ownership. During this phase, your team should:

• Assess existing risks.
• Consider ways to alleviate those risks.
• Look into software that could help improve security.
• Visualize how a breach will affect the organization.
• Train employees how to spot a breach.
• Simulate a breach and perform test runs.
• Integrate existing disaster-recovery protocols into the plan.

Detection and analysis

On average, it takes organizations 197 days to detect a breach — enough time for a hacker to financially cripple even large companies. These are some steps you can take to detect breaches sooner:

• Understand cyber criminals, their motivations and their most recent tactics.
• Keep your security software and key systems patched and running smoothly.
• Use automated breach detection techniques.
• Teach your team how to spot a breach manually, as well as with software.
• Run reports that flag outlying data or anomalies.
• Continuously assess and address new risks.

Containment, eradication and recovery

The containment and recovery phase is an “all hands on deck” situation. Have policies and procedures in place so that key personnel understand exactly how to respond. Everyone should know:

• Who will speak to the public?
• What applications are safe to use and when?
• When can operations resume?

Have a playbook at the ready for various types of incidents so your team can react quickly to recover from the violation. And practice by holding “cyber drills” or tabletop exercises in which everyone on the team responds as they would after a real breach.

Post-incident activity

Document lessons learned: what happened, what went smoothly and what you learned. It can be tempting to skip this step when operations are back to normal, but studying the real-life reactions can help you further improve your readiness, not only to respond more effectively but potentially to prevent a future attack.

The perfect plan is a journey

Don’t think you have to create a perfect incident response plan from the outset. These plans are living documents and will be shaped over time as new threats emerge, new breaches are discovered and technology advances. They should be revised at least annually and reviewed more often if possible. Accept that your plan will be imperfect, embrace it for what it is and strive to make it better every day.

Learn more how Weaver helps companies manage IT risks and improve cybersecurity.

Weaver is a top-40 national accounting firm built on an unwavering commitment to its clients’ success, acting with integrity and always striving to transcend expectations. Beyond assurance and tax services, Weaver offers risk, transaction and IT advisory; energy compliance; forensics and litigation; and SALT, international and private client tax services.