incident response plan

In today’s tech-driven world, where data breaches regularly break into headlines, every organization should have a cyber incident response plan. Unfortunately, too many companies fail to create — and practice — such plans. They may be seen as too costly, too time-consuming, or nonessential, but the ability to quickly respond to a data breach is essential.

What is an incident response plan?

Cybersecurity incidents, commonly known as data or security breaches, are events that compromise the integrity of your information assets, whether your own or your customers’ data, or disrupt your operations. An effective incident response plan can’t prevent a data breach, but it can prepare you to respond.

Some companies have no choice: regulations and standards such as Sarbanes-Oxley (SOX), the Federal Financial Institutions Examination Council (FFIEC) or the Payment Card Industry Data Security Standard (PCI DSS) may require a response. Required or not, every company should make a cyber incident response plan part of its emergency preparedness.

The uncomfortable truth is, data breaches are inevitable. The old adage, “it’s not a matter of if, but when,” still holds true. In a 2018 independent study, the Ponemon Institute estimated that 28% of organizations worldwide will experience a data breach within the next two years. Being able to respond in a way that minimizes damage to both finances and reputation is worth the cost.

What should a response plan include?

No single incident response plan suits everyone. When planning, first carefully analyze your operating environment. What threats are typical for your industry? What technological support do you have? What risks do you face? What are your financial constraints? Look at samples of existing frameworks and see how they could fit into your organization.

The National Institute of Standards and Technology’s Computer Security Incident Handling Guide outlines simple, yet thorough, incident response plan considerations.