{"id":22905,"date":"2023-05-01T20:55:00","date_gmt":"2023-05-01T20:55:00","guid":{"rendered":"https:\/\/principledefence.com\/?p=22905"},"modified":"2023-05-02T12:25:12","modified_gmt":"2023-05-02T12:25:12","slug":"planning-for-the-worst-the-value-of-pessimism","status":"publish","type":"post","link":"https:\/\/principledefence.com\/planning-for-the-worst-the-value-of-pessimism","title":{"rendered":"Planning for the worst: the value of pessimism"},"content":{"rendered":"<div data-elementor-type=\"wp-post\" data-elementor-id=\"22905\" class=\"elementor elementor-22905\" data-elementor-post-type=\"post\">\n\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-5a09d5d elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"5a09d5d\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-cb4c99b\" data-id=\"cb4c99b\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-be59bce elementor-widget elementor-widget-heading\" data-id=\"be59bce\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.21.0 - 15-04-2024 *\/\n.elementor-heading-title{padding:0;margin:0;line-height:1}.elementor-widget-heading .elementor-heading-title[class*=elementor-size-]>a{color:inherit;font-size:inherit;line-height:inherit}.elementor-widget-heading .elementor-heading-title.elementor-size-small{font-size:15px}.elementor-widget-heading .elementor-heading-title.elementor-size-medium{font-size:19px}.elementor-widget-heading .elementor-heading-title.elementor-size-large{font-size:29px}.elementor-widget-heading .elementor-heading-title.elementor-size-xl{font-size:39px}.elementor-widget-heading .elementor-heading-title.elementor-size-xxl{font-size:59px}<\/style><h2 class=\"elementor-heading-title elementor-size-default\"><span style=\"font-size: 20pt; font-family: Arial; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;\">Planning for the worst: the value of pessimism<\/span><\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-89a37b0 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"89a37b0\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-fd2b899\" data-id=\"fd2b899\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-c780a58 elementor-widget elementor-widget-text-editor\" data-id=\"c780a58\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.21.0 - 15-04-2024 *\/\n.elementor-widget-text-editor.elementor-drop-cap-view-stacked .elementor-drop-cap{background-color:#69727d;color:#fff}.elementor-widget-text-editor.elementor-drop-cap-view-framed .elementor-drop-cap{color:#69727d;border:3px solid;background-color:transparent}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap{margin-top:8px}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap-letter{width:1em;height:1em}.elementor-widget-text-editor .elementor-drop-cap{float:left;text-align:center;line-height:1;font-size:50px}.elementor-widget-text-editor .elementor-drop-cap-letter{display:inline-block}<\/style>\t\t\t\t<p><span id=\"docs-internal-guid-b30ba91a-7fff-1f25-93e2-e7f0fcb11a52\"><span style=\"font-size: 11pt; font-family: Arial; color: #000000; background-color: transparent; font-style: italic; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline; white-space: pre-wrap;\">The Department for Science, Innovation and Technology (DSIT &#x2013; a recent amalgamation of parts of DCMS and BEIS) has just released its seventh <a href=\"https:\/\/www.gov.uk\/government\/statistics\/cyber-security-breaches-survey-2023\/cyber-security-breaches-survey-2023\">Cyber Security Breaches Survey<\/a>: an annual data gathering exercise across businesses and charities on their approach to cyber security.&#xA0; In the second of a series of blogs reflecting on its findings, we consider the low numbers of businesses with incident response plans in place, and discuss some practical tips for preparing for a cyber attack.<\/span><\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-2b2a058 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"2b2a058\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-d911bc6\" data-id=\"d911bc6\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-a8da76b elementor-widget elementor-widget-text-editor\" data-id=\"a8da76b\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span id=\"docs-internal-guid-bacb8297-7fff-797d-7780-03cee26f1de6\"><span style=\"font-size: 11pt; font-family: Arial; color: #000000; background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline; white-space: pre-wrap;\">One of the most stark findings of the <a href=\"https:\/\/www.gov.uk\/government\/statistics\/cyber-security-breaches-survey-2023\/cyber-security-breaches-survey-2023\">2023 Cyber Security Breaches Survey<\/a> was the disconnect between the number of cyber incidents, and the number of organisations that plan for them. About a third of businesses and a quarter of charities report having experienced a cyber attack in the last year, rising to 69% of large businesses. Of those, 40% experienced a breach or attack once a month, with a fifth reporting an attempt at least once a week. Yet, the data indicates that only 21% of businesses and 16% of charities have an incident response plan to deal with such an attack. <\/span><\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-0b50583 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"0b50583\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-top-column elementor-element elementor-element-0001c74\" data-id=\"0001c74\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-a326001 elementor-widget elementor-widget-image\" data-id=\"a326001\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.21.0 - 15-04-2024 *\/\n.elementor-widget-image{text-align:center}.elementor-widget-image a{display:inline-block}.elementor-widget-image a img[src$=\".svg\"]{width:48px}.elementor-widget-image img{vertical-align:middle;display:inline-block}<\/style>\t\t\t\t\t\t\t\t\t\t<img fetchpriority=\"high\" decoding=\"async\" width=\"640\" height=\"375\" src=\"https:\/\/principledefence.com\/wp-content\/uploads\/2023\/05\/Orgs-reporting-breaches-in-last-12-months.png\" class=\"attachment-large size-large wp-image-22908\" alt=\"No of orgs reporting breaches in the last 12 months\" srcset=\"https:\/\/principledefence.com\/wp-content\/uploads\/2023\/05\/Orgs-reporting-breaches-in-last-12-months.png 825w, https:\/\/principledefence.com\/wp-content\/uploads\/2023\/05\/Orgs-reporting-breaches-in-last-12-months-500x293.png 500w, https:\/\/principledefence.com\/wp-content\/uploads\/2023\/05\/Orgs-reporting-breaches-in-last-12-months-300x176.png 300w, https:\/\/principledefence.com\/wp-content\/uploads\/2023\/05\/Orgs-reporting-breaches-in-last-12-months-768x450.png 768w\" sizes=\"(max-width: 640px) 100vw, 640px\"\/>\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-44cd27e elementor-widget elementor-widget-text-editor\" data-id=\"44cd27e\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<h6 style=\"text-align: center;\"><span style=\"background-color: transparent; color: rgb(67, 67, 67); font-family: Arial; font-size: 14pt; letter-spacing: 0px; white-space: pre-wrap;\">Figure 1: How often organisations have reported breaches or attacks in the last 12 months (source: DSIT 2023 Cyber Security Breaches Survey)<\/span><br><\/h6>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-top-column elementor-element elementor-element-07c8291\" data-id=\"07c8291\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-edbffba elementor-widget elementor-widget-image\" data-id=\"edbffba\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img decoding=\"async\" width=\"640\" height=\"319\" src=\"https:\/\/principledefence.com\/wp-content\/uploads\/2023\/05\/Percentage-of-orgs-1.1.png\" class=\"attachment-large size-large wp-image-22920\" alt=\"Percentage of organisations that have the following measures in place for dealing with cyber security incidents\" srcset=\"https:\/\/principledefence.com\/wp-content\/uploads\/2023\/05\/Percentage-of-orgs-1.1.png 968w, https:\/\/principledefence.com\/wp-content\/uploads\/2023\/05\/Percentage-of-orgs-1.1-500x249.png 500w, https:\/\/principledefence.com\/wp-content\/uploads\/2023\/05\/Percentage-of-orgs-1.1-300x150.png 300w, https:\/\/principledefence.com\/wp-content\/uploads\/2023\/05\/Percentage-of-orgs-1.1-768x383.png 768w\" sizes=\"(max-width: 640px) 100vw, 640px\"\/>\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-489a7f7 elementor-widget elementor-widget-text-editor\" data-id=\"489a7f7\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<h6 style=\"text-align: center;\"><span style=\"font-size: 14pt; font-family: Arial; color: #434343; background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline; white-space: pre-wrap;\">&#xA0;<\/span><\/h6><h6 style=\"text-align: center;\"><span id=\"docs-internal-guid-a7c58d0a-7fff-274c-cf4d-3e345d9c1681\"><span style=\"font-size: 14pt; font-family: Arial; color: #434343; background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline; white-space: pre-wrap;\">Figure 2: Percentage of organisations that have the following measures in place for dealing with cyber security incidents (source: DSIT 2023 Cyber Security Breaches Survey)<\/span><\/span><\/h6>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-8144f76 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"8144f76\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-91ec89e\" data-id=\"91ec89e\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-d96fd03 elementor-widget elementor-widget-text-editor\" data-id=\"d96fd03\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p dir=\"ltr\" style=\"line-height: 1.38; text-align: justify; margin-top: 0pt; margin-bottom: 0pt;\"><span style=\"font-size: 11pt; font-family: Arial; color: #000000; background-color: transparent; font-weight: 400; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap;\">This headline figure does of course generalise across all types and sizes of business, but even when you consider the data for large businesses and high-income charities only, the results are still worrying: 64% and 38% respectively. Moreover, under half of large businesses had a communications plan in place, despite the <a class=\"glossaryLink cmtt_FAIR\"  aria-describedby=\"tt\"  data-cmtooltip=\"&lt;div class=glossaryItemTitle&gt;Possibility&lt;\/div&gt;&lt;div class=glossaryItemBody&gt; &amp;lt;!-- wp:paragraph --&amp;gt;A chance that something may happen&amp;lt;br\/&amp;gt;&amp;lt;!-- \/wp:paragraph --&amp;gt; &lt;\/div&gt;\"  href=\"https:\/\/principledefence.com\/glossary\/possibility\"  data-mobile-support=\"0\"  data-gt-translate-attributes='[{\"attribute\":\"data-cmtooltip\", \"format\":\"html\"}]' tabindex='0' role='link'>possibility<\/a> of an attack causing large scale service disruption, media attention, and reputational damage.<\/span><\/p><p dir=\"ltr\" style=\"line-height: 1.38; text-align: justify; margin-top: 0pt; margin-bottom: 0pt;\"><span style=\"font-size: 11pt; font-family: Arial; color: #000000; background-color: transparent; font-weight: 400; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap;\">&#xA0;<\/span><\/p><p dir=\"ltr\" style=\"line-height: 1.38; text-align: justify; margin-top: 0pt; margin-bottom: 0pt;\"><span style=\"font-size: 11pt; font-family: Arial; color: #000000; background-color: transparent; font-weight: 400; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap;\">Do these figures represent a continued desire by organisations to stick their head in the sand and hope the worst will never happen? The qualitative evidence from the survey suggests the answer is more complicated than that, with planning hampered by a combination of a lack of expertise, a disconnect between IT teams and senior management, and overall just a sense of the futility of planning for unpredictable events.<\/span><\/p><p dir=\"ltr\" style=\"line-height: 1.38; text-align: justify; margin-top: 0pt; margin-bottom: 0pt;\"><span style=\"font-size: 11pt; font-family: Arial; color: #000000; background-color: transparent; font-weight: 400; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap;\">&#xA0;<\/span><\/p><p dir=\"ltr\" style=\"line-height: 1.38; text-align: justify; margin-top: 0pt; margin-bottom: 0pt;\"><span style=\"font-size: 11pt; font-family: Arial; color: #000000; background-color: transparent; font-weight: 400; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap;\">With this in mind, we offer five tips to support pragmatic incident planning within your organisation: <\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-672deed elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"672deed\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-5f0f8dc\" data-id=\"5f0f8dc\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-a2a8b31 elementor-widget elementor-widget-heading\" data-id=\"a2a8b31\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\"><span style=\"font-size: 16pt; font-family: Arial; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;\">Five tips for pragmatic planning<\/span><\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-c1d2b96 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"c1d2b96\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-5a4e167\" data-id=\"5a4e167\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-58591f7 elementor-widget elementor-widget-text-editor\" data-id=\"58591f7\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<ol style=\"margin-top: 0; margin-bottom: 0; padding-inline-start: 48px;\"><li dir=\"ltr\" style=\"list-style-type: decimal; font-size: 11pt; font-family: Arial; color: #000000; background-color: transparent; font-weight: bold; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre;\" aria-level=\"1\"><span style=\"font-size: 11pt; font-family: Arial; color: #000000; background-color: transparent; font-weight: bold; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap;\">Plan for outcomes, not scenarios<\/span><\/li><\/ol><p dir=\"ltr\" style=\"line-height: 1.38; margin-left: 36pt; text-align: justify; margin-top: 0pt; margin-bottom: 0pt;\"><span style=\"font-size: 11pt; font-family: Arial; color: #000000; background-color: transparent; font-weight: 400; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap;\">Cyber attacks can come in many different forms, and writing a bespoke plan for each variation of virus is burdensome (and, moreover, would most likely confuse the actual response, especially when the attack&rsquo;s cause might not always be immediately known). However, planning for outcomes is more predictable and will enable your organisation to adapt and respond to multiple sorts of attacks: now and in the future. Map out what impacts a successful attack could have on your organisation (e.g. service disruption, loss of <a class=\"glossaryLink cmtt_Data Protection\"  aria-describedby=\"tt\"  data-cmtooltip=\"&lt;div class=glossaryItemTitle&gt;Personal Data&lt;\/div&gt;&lt;div class=glossaryItemBody&gt; &amp;lt;!-- wp:paragraph --&amp;gt;Any information relating to an identified or identifiable natural person&amp;lt;br\/&amp;gt;&amp;lt;!-- \/wp:paragraph --&amp;gt; &lt;\/div&gt;\"  href=\"https:\/\/principledefence.com\/glossary\/personal-data\"  data-mobile-support=\"0\"  data-gt-translate-attributes='[{\"attribute\":\"data-cmtooltip\", \"format\":\"html\"}]' tabindex='0' role='link'>personal data<\/a>, loss of corporate functions) and plan for these, rather than every potential eventuality. You&rsquo;ll find your incident response plan(s) can be much clearer and more streamlined as a result.<\/span><\/p><p dir=\"ltr\" style=\"line-height: 1.38; margin-left: 36pt; text-align: justify; margin-top: 0pt; margin-bottom: 0pt;\"><span style=\"font-size: 11pt; font-family: Arial; color: #000000; background-color: transparent; font-weight: 400; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap;\">&#xA0;<\/span><\/p><ol style=\"margin-top: 0; margin-bottom: 0; padding-inline-start: 48px;\" start=\"2\"><li dir=\"ltr\" style=\"list-style-type: decimal; font-size: 11pt; font-family: Arial; color: #000000; background-color: transparent; font-weight: bold; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre;\" aria-level=\"1\"><p dir=\"ltr\" style=\"line-height: 1.38; text-align: justify; margin-top: 0pt; margin-bottom: 0pt;\" role=\"presentation\"><span style=\"font-size: 11pt; font-family: Arial; color: #000000; background-color: transparent; font-weight: bold; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap;\">Bring others in<\/span><\/p><\/li><\/ol><p dir=\"ltr\" style=\"line-height: 1.38; margin-left: 36pt; text-align: justify; margin-top: 0pt; margin-bottom: 0pt;\"><span style=\"font-size: 11pt; font-family: Arial; color: #000000; background-color: transparent; font-weight: 400; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap;\">A successful cyber attack doesn&#x2019;t just affect IT teams, but will have ramifications for functions and operations across the entire business. Your incident plan needs to take account of how the organisation will deal with HR, legal, financial and customer-facing impacts as well as the technical resolution of the issue itself. Likewise many decisions &#x2018;on the day&#x2019; may need to be taken by responsible functional leads. Running an informal table-top exercise to dig through the possible implications of an attack across the business can not only help you understand what to expect, but also provide a helpful means of raising awareness and upskilling your colleagues of what they may need to do in the event of an attack.<\/span><\/p><p dir=\"ltr\" style=\"line-height: 1.38; margin-left: 36pt; text-align: justify; margin-top: 0pt; margin-bottom: 0pt;\"><span style=\"font-size: 11pt; font-family: Arial; color: #000000; background-color: transparent; font-weight: 400; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap;\">&#xA0;<\/span><\/p><ol style=\"margin-top: 0; margin-bottom: 0; padding-inline-start: 48px;\" start=\"3\"><li dir=\"ltr\" style=\"list-style-type: decimal; font-size: 11pt; font-family: Arial; color: #000000; background-color: transparent; font-weight: bold; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre;\" aria-level=\"1\"><p dir=\"ltr\" style=\"line-height: 1.38; text-align: justify; margin-top: 0pt; margin-bottom: 0pt;\" role=\"presentation\"><span style=\"font-size: 11pt; font-family: Arial; color: #000000; background-color: transparent; font-weight: bold; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap;\">Practice makes perfect<\/span><\/p><\/li><\/ol><p dir=\"ltr\" style=\"line-height: 1.38; margin-left: 36pt; text-align: justify; margin-top: 0pt; margin-bottom: 0pt;\"><span style=\"font-size: 11pt; font-family: Arial; color: #000000; background-color: transparent; font-weight: 400; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap;\">One of the hardest parts about incident response planning is, counterintuitively, when the incident never ends up happening. Plans are forgotten, people move on, and circumstances (corporate structures, responsibilities and clients) change. Under these circumstances, complacency and skill-fade easily set in. Counter this by planning out an annual programme of training, exercises and drills that keeps knowledge fresh and maintains interest. Not only will it enable you to keep your people prepared and ready, but it should allow you to ensure your plans remain up-to-date as well.&#xA0;<\/span><\/p><p dir=\"ltr\" style=\"line-height: 1.38; margin-left: 36pt; text-align: justify; margin-top: 0pt; margin-bottom: 0pt;\"><span style=\"font-size: 11pt; font-family: Arial; color: #000000; background-color: transparent; font-weight: 400; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap;\">&#xA0;<\/span><\/p><p dir=\"ltr\" style=\"line-height: 1.38; margin-left: 36pt; text-align: justify; margin-top: 0pt; margin-bottom: 0pt;\"><span style=\"font-size: 11pt; font-family: Arial; color: #000000; background-color: transparent; font-weight: 400; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap;\">To avoid any <a class=\"glossaryLink cmtt_FAIR\"  aria-describedby=\"tt\"  data-cmtooltip=\"&lt;div class=glossaryItemTitle&gt;Risk&lt;\/div&gt;&lt;div class=glossaryItemBody&gt; &amp;lt;!-- wp:paragraph --&amp;gt;The probable &amp;lt;strong&amp;gt;frequency&amp;lt;\/strong&amp;gt; and probable &amp;lt;strong&amp;gt;magnitude&amp;lt;\/strong&amp;gt; of &amp;lt;strong&amp;gt;future&amp;lt;\/strong&amp;gt; loss&amp;lt;br\/&amp;gt;&amp;lt;!-- \/wp:paragraph --&amp;gt; &lt;\/div&gt;\"  href=\"https:\/\/principledefence.com\/glossary\/risk\"  data-mobile-support=\"0\"  data-gt-translate-attributes='[{\"attribute\":\"data-cmtooltip\", \"format\":\"html\"}]' tabindex='0' role='link'>risk<\/a> of overburdening people, keep the roles, processes and accountabilities as similar as possible from exercise to exercise, whilst keeping the scenarios fresh and interesting. This will help participants to practise their roles and improve their skills with each iteration, whilst ensuring each exercise brings fresh interest and learning.&nbsp;&nbsp;<\/span><\/p><p dir=\"ltr\" style=\"line-height: 1.38; margin-left: 36pt; text-align: justify; margin-top: 0pt; margin-bottom: 0pt;\"><span style=\"font-size: 11pt; font-family: Arial; color: #000000; background-color: transparent; font-weight: 400; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap;\">&#xA0;<\/span><\/p><ol style=\"margin-top: 0; margin-bottom: 0; padding-inline-start: 48px;\" start=\"4\"><li dir=\"ltr\" style=\"list-style-type: decimal; font-size: 11pt; font-family: Arial; color: #000000; background-color: transparent; font-weight: bold; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre;\" aria-level=\"1\"><p dir=\"ltr\" style=\"line-height: 1.38; text-align: justify; margin-top: 0pt; margin-bottom: 0pt;\" role=\"presentation\"><span style=\"font-size: 11pt; font-family: Arial; color: #000000; background-color: transparent; font-weight: bold; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap;\">Incident response vs business continuity&#xA0;<\/span><\/p><\/li><\/ol><p dir=\"ltr\" style=\"line-height: 1.296; text-align: justify; margin: 0pt 0.34251968503937746pt 6pt 36pt;\"><span style=\"font-size: 11pt; font-family: Arial; color: #000000; background-color: transparent; font-weight: 400; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap;\">In addition to your incident response procedures, which will focus on the steps needed to respond to an attack, you should also consider creating an additional Business Continuity or Disaster Recovery plan. This specifically considers how your organisation will recover from an attack, and\/or how its most essential functions will be maintained in the meantime.&#xA0; These plans and procedures are especially important in the wake of a disruptive attack which may cripple your usual service delivery or permanently remove your access to particular systems.&#xA0;<\/span><\/p><p dir=\"ltr\" style=\"line-height: 1.296; text-align: justify; margin: 0pt 0.34251968503937746pt 6pt 36pt;\"><span style=\"font-size: 11pt; font-family: Arial; color: #000000; background-color: transparent; font-weight: 400; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap;\">Disaster recovery plans should consider issues like key business operations that must be kept running, the priority order for recovering services, and the creation of a &#x2018;Minimum Viable Company&#x2019;. It could answer questions such as where you would procure essential equipment at short notice, how you would recover your information, and how you would continue providing services to customers in the meantime.<\/span><\/p><p dir=\"ltr\" style=\"line-height: 1.296; text-align: justify; margin: 0pt 0.34251968503937746pt 6pt 36pt;\"><span style=\"font-size: 11pt; font-family: Arial; color: #000000; background-color: transparent; font-weight: 400; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap;\">&#xA0;<\/span><\/p><ol style=\"margin-top: 0; margin-bottom: 0; padding-inline-start: 48px;\" start=\"5\"><li dir=\"ltr\" style=\"list-style-type: decimal; font-size: 11pt; font-family: Arial; color: #000000; background-color: transparent; font-weight: bold; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre;\" aria-level=\"1\"><p dir=\"ltr\" style=\"line-height: 1.38; text-align: justify; margin-top: 0pt; margin-bottom: 0pt;\" role=\"presentation\"><span style=\"font-size: 11pt; font-family: Arial; color: #000000; background-color: transparent; font-weight: bold; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap;\">Communication, communication, communication<\/span><\/p><\/li><\/ol><p dir=\"ltr\" style=\"line-height: 1.38; margin-left: 36pt; text-align: justify; margin-top: 0pt; margin-bottom: 0pt;\"><span style=\"font-size: 11pt; font-family: Arial; color: #000000; background-color: transparent; font-weight: 400; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap;\">As the survey showed, even amongst businesses that have formal incident response plans, the numbers with an associated communications plan are really low &#x2013; just 15%. But in a world where a successful cyber attack can bring down your business or ruin your reputation, it is increasingly naive to hope that incidents can be kept under the radar from your customers. Prepping your key messages in advance and ensuring your PR team is bought into your public communications strategy will avoid mixed messages or embarrassing delays in the event.&#xA0;<\/span><\/p><p dir=\"ltr\" style=\"line-height: 1.38; margin-left: 36pt; text-align: justify; margin-top: 0pt; margin-bottom: 0pt;\"><span style=\"background-color: transparent; color: #000000; font-family: Arial; font-size: 11pt; white-space: pre-wrap;\">&#xA0;<\/span><\/p><p dir=\"ltr\" style=\"line-height: 1.38; margin-left: 36pt; text-align: justify; margin-top: 0pt; margin-bottom: 0pt;\"><span style=\"background-color: transparent; color: #000000; font-family: Arial; font-size: 11pt; white-space: pre-wrap;\">Even if the disruption is confined to internal operations, you will need to have a plan to communicate with your employees as to what action they should take (or shouldn&#x2019;t take!). When developing your internal and external communications strategy, consider that, in some worst-case scenarios, you and\/or your employees may not have access to normal channels of communication, and consider alternative information routes such as phone trees or mobile alerting systems.<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-7757f42 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"7757f42\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-567234f\" data-id=\"567234f\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-50e303f elementor-widget elementor-widget-text-editor\" data-id=\"50e303f\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span id=\"docs-internal-guid-569fc92a-7fff-a425-de64-0979d5b84379\"><span style=\"font-size: 11pt; font-family: Arial; color: #000000; background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline; white-space: pre-wrap;\">Don&#x2019;t let your first successful cyber attack come as a surprise &#x2013; accept that, even with the best controls in the world, you are always vulnerable, and prepare accordingly.<\/span><\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-7a11275 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"7a11275\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-14308e7\" data-id=\"14308e7\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-b941d3f elementor-widget elementor-widget-text-editor\" data-id=\"b941d3f\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span id=\"docs-internal-guid-c4d3b60c-7fff-cfa2-c2cd-96602fea10b7\"><span style=\"font-size: 11pt; font-family: Arial; color: #000000; background-color: transparent; font-style: italic; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline; white-space: pre-wrap;\">Principle Defence can support your organisation to consider its incident response plans, including running exercises for a range of scales and scenarios. Our free &#x2018;<a href=\"https:\/\/principledefence.com\/product\/cybersecurity-key-terms-and-concepts-ebook\">Cybersecurity Key Terms and Concepts<\/a>&#x2019; e-book also has some helpful primers on disaster recovery, response procedures and exercising for those starting on their incident planning journey. Get in touch if you&#x2019;d like to know more. <\/span><\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-b7e762b elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"b7e762b\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-aaadef6\" data-id=\"aaadef6\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-c7062de elementor-widget elementor-widget-rs-cf7\" data-id=\"c7062de\" data-element_type=\"widget\" data-widget_type=\"rs-cf7.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\n<div class=\"wpcf7 no-js\" id=\"wpcf7-f18-o1\" lang=\"en-US\" dir=\"ltr\">\n<div class=\"screen-reader-response\"><p role=\"status\" aria-live=\"polite\" aria-atomic=\"true\"><\/p> <ul><\/ul><\/div>\n<form action=\"\/wp-json\/wp\/v2\/posts\/22905#wpcf7-f18-o1\" method=\"post\" class=\"wpcf7-form init\" aria-label=\"Contact form\" novalidate=\"novalidate\" data-status=\"init\">\n<div style=\"display: none;\">\n<input type=\"hidden\" name=\"_wpcf7\" value=\"18\">\n<input type=\"hidden\" name=\"_wpcf7_version\" value=\"5.9.3\">\n<input type=\"hidden\" name=\"_wpcf7_locale\" value=\"en_US\">\n<input type=\"hidden\" name=\"_wpcf7_unit_tag\" value=\"wpcf7-f18-o1\">\n<input type=\"hidden\" name=\"_wpcf7_container_post\" value=\"0\">\n<input type=\"hidden\" name=\"_wpcf7_posted_data_hash\" value=\"\">\n<\/div>\n<p><label> Your name<br>\n<span class=\"wpcf7-form-control-wrap\" data-name=\"your-name\"><input size=\"40\" class=\"wpcf7-form-control wpcf7-text wpcf7-validates-as-required\" aria-required=\"true\" aria-invalid=\"false\" value=\"\" type=\"text\" name=\"your-name\"><\/span> <\/label>\n<\/p>\n<p><label> Your email<br>\n<span class=\"wpcf7-form-control-wrap\" data-name=\"your-email\"><input size=\"40\" class=\"wpcf7-form-control wpcf7-email wpcf7-validates-as-required wpcf7-text wpcf7-validates-as-email\" aria-required=\"true\" aria-invalid=\"false\" value=\"\" type=\"email\" name=\"your-email\"><\/span> <\/label>\n<\/p>\n<p><label> Subject<br>\n<span class=\"wpcf7-form-control-wrap\" data-name=\"your-subject\"><input size=\"40\" class=\"wpcf7-form-control wpcf7-text wpcf7-validates-as-required\" aria-required=\"true\" aria-invalid=\"false\" value=\"\" type=\"text\" name=\"your-subject\"><\/span> <\/label>\n<\/p>\n<p><label> Your message (optional)<br>\n<span class=\"wpcf7-form-control-wrap\" data-name=\"your-message\"><textarea cols=\"40\" rows=\"10\" class=\"wpcf7-form-control wpcf7-textarea\" aria-invalid=\"false\" name=\"your-message\"><\/textarea><\/span> <\/label>\n<\/p>\n<p><input class=\"wpcf7-form-control wpcf7-submit has-spinner\" type=\"submit\" value=\"Submit\">\n<\/p><div class=\"wpcf7-response-output\" aria-hidden=\"true\"><\/div>\n<\/form>\n<\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>Planning for the worst: the value of pessimism The Department for Science, Innovation and Technology (DSIT &#x2013; a recent amalgamation of parts of DCMS and BEIS) has just released its seventh Cyber Security Breaches Survey: an annual data gathering exercise across businesses and charities on their approach to cyber security.&#xA0; In the second of a&#x2026;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[130,131,102],"tags":[132,133,69],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v22.6 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Planning for the worst: the value of pessimism - Principle Defence<\/title>\n<meta name=\"description\" content=\"Incident response plans aid organisations &#039;plan for the worst&#039; for when cyber attacks happen and to reduce their impact.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/principledefence.com\/planning-for-the-worst-the-value-of-pessimism\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Planning for the worst: the value of pessimism - Principle Defence\" \/>\n<meta property=\"og:description\" content=\"Incident response plans aid organisations &#039;plan for the worst&#039; for when cyber attacks happen and to reduce their impact.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/principledefence.com\/planning-for-the-worst-the-value-of-pessimism\" \/>\n<meta property=\"og:site_name\" content=\"Principle Defence\" \/>\n<meta property=\"article:published_time\" content=\"2023-05-01T20:55:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-05-02T12:25:12+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/principledefence.com\/wp-content\/uploads\/2023\/05\/Orgs-reporting-breaches-in-last-12-months.png\" \/>\n<meta name=\"author\" content=\"Jim\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@PrinciplDefence\" \/>\n<meta name=\"twitter:site\" content=\"@PrinciplDefence\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Jim\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":[\"Article\",\"BlogPosting\"],\"@id\":\"https:\/\/principledefence.com\/planning-for-the-worst-the-value-of-pessimism#article\",\"isPartOf\":{\"@id\":\"https:\/\/principledefence.com\/planning-for-the-worst-the-value-of-pessimism\"},\"author\":{\"name\":\"Jim\",\"@id\":\"https:\/\/principledefence.com\/#\/schema\/person\/dea03a3d37b80c5da008f871384cd229\"},\"headline\":\"Planning for the worst: the value of pessimism\",\"datePublished\":\"2023-05-01T20:55:00+00:00\",\"dateModified\":\"2023-05-02T12:25:12+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/principledefence.com\/planning-for-the-worst-the-value-of-pessimism\"},\"wordCount\":1197,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/principledefence.com\/#organization\"},\"image\":{\"@id\":\"https:\/\/principledefence.com\/planning-for-the-worst-the-value-of-pessimism#primaryimage\"},\"thumbnailUrl\":\"https:\/\/principledefence.com\/wp-content\/uploads\/2023\/05\/Orgs-reporting-breaches-in-last-12-months.png\",\"keywords\":[\"Incident Response\",\"Incident Response Plan\",\"Risk Management\"],\"articleSection\":[\"Incident Response\",\"Incident Response Plan\",\"Risk Management\"],\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/principledefence.com\/planning-for-the-worst-the-value-of-pessimism#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/principledefence.com\/planning-for-the-worst-the-value-of-pessimism\",\"url\":\"https:\/\/principledefence.com\/planning-for-the-worst-the-value-of-pessimism\",\"name\":\"Planning for the worst: the value of pessimism - Principle Defence\",\"isPartOf\":{\"@id\":\"https:\/\/principledefence.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/principledefence.com\/planning-for-the-worst-the-value-of-pessimism#primaryimage\"},\"image\":{\"@id\":\"https:\/\/principledefence.com\/planning-for-the-worst-the-value-of-pessimism#primaryimage\"},\"thumbnailUrl\":\"https:\/\/principledefence.com\/wp-content\/uploads\/2023\/05\/Orgs-reporting-breaches-in-last-12-months.png\",\"datePublished\":\"2023-05-01T20:55:00+00:00\",\"dateModified\":\"2023-05-02T12:25:12+00:00\",\"description\":\"Incident response plans aid organisations 'plan for the worst' for when cyber attacks happen and to reduce their impact.\",\"breadcrumb\":{\"@id\":\"https:\/\/principledefence.com\/planning-for-the-worst-the-value-of-pessimism#breadcrumb\"},\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/principledefence.com\/planning-for-the-worst-the-value-of-pessimism\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/principledefence.com\/planning-for-the-worst-the-value-of-pessimism#primaryimage\",\"url\":\"https:\/\/principledefence.com\/wp-content\/uploads\/2023\/05\/Orgs-reporting-breaches-in-last-12-months.png\",\"contentUrl\":\"https:\/\/principledefence.com\/wp-content\/uploads\/2023\/05\/Orgs-reporting-breaches-in-last-12-months.png\",\"width\":825,\"height\":483,\"caption\":\"No of orgs reporting breaches in the last 12 months\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/principledefence.com\/planning-for-the-worst-the-value-of-pessimism#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/principledefence.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Planning for the worst: the value of pessimism\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/principledefence.com\/#website\",\"url\":\"https:\/\/principledefence.com\/\",\"name\":\"Principle Defence\",\"description\":\"Risk Based Solutions\",\"publisher\":{\"@id\":\"https:\/\/principledefence.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/principledefence.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-GB\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/principledefence.com\/#organization\",\"name\":\"Principle Defence\",\"url\":\"https:\/\/principledefence.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/principledefence.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/principledefence.com\/wp-content\/uploads\/2022\/09\/Principle-Defence-Logo.png\",\"contentUrl\":\"https:\/\/principledefence.com\/wp-content\/uploads\/2022\/09\/Principle-Defence-Logo.png\",\"width\":1879,\"height\":1488,\"caption\":\"Principle Defence\"},\"image\":{\"@id\":\"https:\/\/principledefence.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/x.com\/PrinciplDefence\",\"https:\/\/www.linkedin.com\/company\/principle-defence\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/principledefence.com\/#\/schema\/person\/dea03a3d37b80c5da008f871384cd229\",\"name\":\"Jim\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/principledefence.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/a3ab2dd9a6ba227674f3d91dcd70064a?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/a3ab2dd9a6ba227674f3d91dcd70064a?s=96&d=mm&r=g\",\"caption\":\"Jim\"},\"sameAs\":[\"https:\/\/principledefence.com\"],\"url\":\"https:\/\/principledefence.com\/author\/jim\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Planning for the worst: the value of pessimism - Principle Defence","description":"Incident response plans aid organisations 'plan for the worst' for when cyber attacks happen and to reduce their impact.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/principledefence.com\/planning-for-the-worst-the-value-of-pessimism","og_locale":"en_GB","og_type":"article","og_title":"Planning for the worst: the value of pessimism - Principle Defence","og_description":"Incident response plans aid organisations 'plan for the worst' for when cyber attacks happen and to reduce their impact.","og_url":"https:\/\/principledefence.com\/planning-for-the-worst-the-value-of-pessimism","og_site_name":"Principle Defence","article_published_time":"2023-05-01T20:55:00+00:00","article_modified_time":"2023-05-02T12:25:12+00:00","og_image":[{"url":"https:\/\/principledefence.com\/wp-content\/uploads\/2023\/05\/Orgs-reporting-breaches-in-last-12-months.png"}],"author":"Jim","twitter_card":"summary_large_image","twitter_creator":"@PrinciplDefence","twitter_site":"@PrinciplDefence","twitter_misc":{"Written by":"Jim","Estimated reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":["Article","BlogPosting"],"@id":"https:\/\/principledefence.com\/planning-for-the-worst-the-value-of-pessimism#article","isPartOf":{"@id":"https:\/\/principledefence.com\/planning-for-the-worst-the-value-of-pessimism"},"author":{"name":"Jim","@id":"https:\/\/principledefence.com\/#\/schema\/person\/dea03a3d37b80c5da008f871384cd229"},"headline":"Planning for the worst: the value of pessimism","datePublished":"2023-05-01T20:55:00+00:00","dateModified":"2023-05-02T12:25:12+00:00","mainEntityOfPage":{"@id":"https:\/\/principledefence.com\/planning-for-the-worst-the-value-of-pessimism"},"wordCount":1197,"commentCount":0,"publisher":{"@id":"https:\/\/principledefence.com\/#organization"},"image":{"@id":"https:\/\/principledefence.com\/planning-for-the-worst-the-value-of-pessimism#primaryimage"},"thumbnailUrl":"https:\/\/principledefence.com\/wp-content\/uploads\/2023\/05\/Orgs-reporting-breaches-in-last-12-months.png","keywords":["Incident Response","Incident Response Plan","Risk Management"],"articleSection":["Incident Response","Incident Response Plan","Risk Management"],"inLanguage":"en-GB","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/principledefence.com\/planning-for-the-worst-the-value-of-pessimism#respond"]}]},{"@type":"WebPage","@id":"https:\/\/principledefence.com\/planning-for-the-worst-the-value-of-pessimism","url":"https:\/\/principledefence.com\/planning-for-the-worst-the-value-of-pessimism","name":"Planning for the worst: the value of pessimism - Principle Defence","isPartOf":{"@id":"https:\/\/principledefence.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/principledefence.com\/planning-for-the-worst-the-value-of-pessimism#primaryimage"},"image":{"@id":"https:\/\/principledefence.com\/planning-for-the-worst-the-value-of-pessimism#primaryimage"},"thumbnailUrl":"https:\/\/principledefence.com\/wp-content\/uploads\/2023\/05\/Orgs-reporting-breaches-in-last-12-months.png","datePublished":"2023-05-01T20:55:00+00:00","dateModified":"2023-05-02T12:25:12+00:00","description":"Incident response plans aid organisations 'plan for the worst' for when cyber attacks happen and to reduce their impact.","breadcrumb":{"@id":"https:\/\/principledefence.com\/planning-for-the-worst-the-value-of-pessimism#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/principledefence.com\/planning-for-the-worst-the-value-of-pessimism"]}]},{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/principledefence.com\/planning-for-the-worst-the-value-of-pessimism#primaryimage","url":"https:\/\/principledefence.com\/wp-content\/uploads\/2023\/05\/Orgs-reporting-breaches-in-last-12-months.png","contentUrl":"https:\/\/principledefence.com\/wp-content\/uploads\/2023\/05\/Orgs-reporting-breaches-in-last-12-months.png","width":825,"height":483,"caption":"No of orgs reporting breaches in the last 12 months"},{"@type":"BreadcrumbList","@id":"https:\/\/principledefence.com\/planning-for-the-worst-the-value-of-pessimism#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/principledefence.com\/"},{"@type":"ListItem","position":2,"name":"Planning for the worst: the value of pessimism"}]},{"@type":"WebSite","@id":"https:\/\/principledefence.com\/#website","url":"https:\/\/principledefence.com\/","name":"Principle Defence","description":"Risk Based Solutions","publisher":{"@id":"https:\/\/principledefence.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/principledefence.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-GB"},{"@type":"Organization","@id":"https:\/\/principledefence.com\/#organization","name":"Principle Defence","url":"https:\/\/principledefence.com\/","logo":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/principledefence.com\/#\/schema\/logo\/image\/","url":"https:\/\/principledefence.com\/wp-content\/uploads\/2022\/09\/Principle-Defence-Logo.png","contentUrl":"https:\/\/principledefence.com\/wp-content\/uploads\/2022\/09\/Principle-Defence-Logo.png","width":1879,"height":1488,"caption":"Principle Defence"},"image":{"@id":"https:\/\/principledefence.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/PrinciplDefence","https:\/\/www.linkedin.com\/company\/principle-defence"]},{"@type":"Person","@id":"https:\/\/principledefence.com\/#\/schema\/person\/dea03a3d37b80c5da008f871384cd229","name":"Jim","image":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/principledefence.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/a3ab2dd9a6ba227674f3d91dcd70064a?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/a3ab2dd9a6ba227674f3d91dcd70064a?s=96&d=mm&r=g","caption":"Jim"},"sameAs":["https:\/\/principledefence.com"],"url":"https:\/\/principledefence.com\/author\/jim"}]}},"_links":{"self":[{"href":"https:\/\/principledefence.com\/wp-json\/wp\/v2\/posts\/22905"}],"collection":[{"href":"https:\/\/principledefence.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/principledefence.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/principledefence.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/principledefence.com\/wp-json\/wp\/v2\/comments?post=22905"}],"version-history":[{"count":18,"href":"https:\/\/principledefence.com\/wp-json\/wp\/v2\/posts\/22905\/revisions"}],"predecessor-version":[{"id":22927,"href":"https:\/\/principledefence.com\/wp-json\/wp\/v2\/posts\/22905\/revisions\/22927"}],"wp:attachment":[{"href":"https:\/\/principledefence.com\/wp-json\/wp\/v2\/media?parent=22905"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/principledefence.com\/wp-json\/wp\/v2\/categories?post=22905"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/principledefence.com\/wp-json\/wp\/v2\/tags?post=22905"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}