1. Plan for outcomes, not scenarios

Cyber attacks can come in many different forms, and writing a bespoke plan for each variation of virus is burdensome (and, moreover, would most likely confuse the actual response, especially when the attack’s cause might not always be immediately known). However, planning for outcomes is more predictable and will enable your organisation to adapt and respond to multiple sorts of attacks: now and in the future. Map out what impacts a successful attack could have on your organisation (e.g. service disruption, loss of personal data, loss of corporate functions) and plan for these, rather than every potential eventuality. You’ll find your incident response plan(s) can be much clearer and more streamlined as a result.

2. Bring others in

A successful cyber attack doesn’t just affect IT teams, but will have ramifications for functions and operations across the entire business. Your incident plan needs to take account of how the organisation will deal with HR, legal, financial and customer-facing impacts as well as the technical resolution of the issue itself. Likewise many decisions ‘on the day’ may need to be taken by responsible functional leads. Running an informal table-top exercise to dig through the possible implications of an attack across the business can not only help you understand what to expect, but also provide a helpful means of raising awareness and upskilling your colleagues of what they may need to do in the event of an attack.

3. Practice makes perfect

One of the hardest parts about incident response planning is, counterintuitively, when the incident never ends up happening. Plans are forgotten, people move on, and circumstances (corporate structures, responsibilities and clients) change. Under these circumstances, complacency and skill-fade easily set in. Counter this by planning out an annual programme of training, exercises and drills that keeps knowledge fresh and maintains interest. Not only will it enable you to keep your people prepared and ready, but it should allow you to ensure your plans remain up-to-date as well. 

To avoid any risk of overburdening people, keep the roles, processes and accountabilities as similar as possible from exercise to exercise, whilst keeping the scenarios fresh and interesting. This will help participants to practise their roles and improve their skills with each iteration, whilst ensuring each exercise brings fresh interest and learning.  

4. Incident response vs business continuity 

In addition to your incident response procedures, which will focus on the steps needed to respond to an attack, you should also consider creating an additional Business Continuity or Disaster Recovery plan. This specifically considers how your organisation will recover from an attack, and/or how its most essential functions will be maintained in the meantime.  These plans and procedures are especially important in the wake of a disruptive attack which may cripple your usual service delivery or permanently remove your access to particular systems. 

Disaster recovery plans should consider issues like key business operations that must be kept running, the priority order for recovering services, and the creation of a ‘Minimum Viable Company’. It could answer questions such as where you would procure essential equipment at short notice, how you would recover your information, and how you would continue providing services to customers in the meantime.

5. Communication, communication, communication

As the survey showed, even amongst businesses that have formal incident response plans, the numbers with an associated communications plan are really low – just 15%. But in a world where a successful cyber attack can bring down your business or ruin your reputation, it is increasingly naive to hope that incidents can be kept under the radar from your customers. Prepping your key messages in advance and ensuring your PR team is bought into your public communications strategy will avoid mixed messages or embarrassing delays in the event. 

Even if the disruption is confined to internal operations, you will need to have a plan to communicate with your employees as to what action they should take (or shouldn’t take!). When developing your internal and external communications strategy, consider that, in some worst-case scenarios, you and/or your employees may not have access to normal channels of communication, and consider alternative information routes such as phone trees or mobile alerting systems.