The threat of a cyber attack is constantly present and 80% of IT business leaders expect to face a critical breach this year. Companies who experience a data breach can expect loss of revenue due to downtime, reputation and recovery. One of the ways a company can reduce the impact of a cyber attack is to implement an incident response plan. According to a study done by IBM, having an incident response plan in place can save a company an average of $340,000.

Source: IBM 

What is an Incident Response Plan?

An incident response plan is used to help organizations detect threats and minimize the impact of a security incident. An incident response plan is key for organizations to build the foundation of their defence. An effective incident response plan will ensure business continuity in the event of an attack and can help prevent a similar event from happening in the future.

What are the Benefits?

Compliance: Regulations like PIPEDA require organizations to keep and maintain records of any data breaches. Having an incident response plan can assist with record keeping and provide quick access to your records.

Trust: Give your clients and investors the confidence in knowing that your company is ready to respond to any security incident.

Clarity: An effective incident response plan will allow all organization personnel to know their responsibilities, leading to faster response time and clear communication across the organization and between the media/stakeholders.

5 Key Components for An Incident Response Plan

1. Determine critical areas of your network: Visibility is an important part of a response plan because when disaster strikes, things can get chaotic. It’s important to look at every part of your environment and prioritize your assets. Knowing the key assets of your business will ensure your critical components will be protected.

2. Evaluate risks: Your incident response plan should cover common threats that are prevalent in the threat landscape, such as ransomware and DDOS attacks. Vulnerabilities tend to be made aware after the fact so an important part of prevention is to find the risks before they become a problem. One way to evaluate your risk factors is to conduct a security risk assessment. A security risk assessment can help you address current risks that are specific to your organization.

3. Incident Response Team: A crucial part of an incident response plan is to have a team of key players to help mitigate immediate issues and plan for other problems (such as media communication). Assigning the proper roles to your staff members to ensure that when the time comes, everyone knows their responsibilities. Your team should include: executives, a security analyst, IT manager, communications and human resources. You may also include third parties such as legal counsel or third party stakeholders. Your team should be briefed of your incident response plan annually and update the plan if necessary.

4. Create a business continuity plan: In the event of a breach, your business operations may not be accessible. In order to limit downtime, you need to figure out a way to access business critical data. This is why it’s important to backup your data regularly so that when the time comes, you have a backup system ready to go.

5. Involve your staff: All employees should have knowledge of and be familiar with your incident response plan. Full cooperation with all employees can limit distractions and delays. Train all employees on your plan, whether they’re part of your incident response team or not.