Welcome to installment four of our Cybersecurity x Sustainability series. So far, we have considered prevention and protection measures that can be employed to reduce the risk of cyber attacks. This month, we will focus on preparation strategies that can be developed and tested to allow for business continuity and effective response following a cybersecurity incident.
Assessing Downstream Impacts
Understanding the range of impacts and necessary workarounds to employ following a security event can lead planning discussions. The products and/or services your company supplies and the clients you serve will determine the notifications and timelines that will take priority in alerting others of the issue.
For instance, if you’re selling giant foam fingers to professional sports teams and it’s the end of the season, then you have some wiggle room. But if you’re providing encryption services to federal defense contractors, that’s an entirely different scenario.
Critical Information Storage
Having contact information for vital personnel and clients securely stored in a location independent of your primary IT systems (which may be targeted and compromised) is key to being able to perform immediate outreach in the event of a system lockdown or failure.
Is there a separate IT device or system not attached to the primary network that a hacker wouldn’t be able to see or target? What about a secure physical location to have hard copies of contact information stored? Does your plan include roles and responsibilities about who directs outreach and response following an event? Better have copies of those procedures stored somewhere other than your primary system if you lose access.
Ensuring you have current system data backups performed and stored where they can be utilized to restore operations can help. Outlining restoration procedures and testing them before an attack may reveal gaps or failures that need attention.
Backup Communication Plans
With the vast majority of communications occurring in the digital realm (I mean, who picks up the phone to call anymore?), how will you relay vital information in the event of a complete system shutdown?
Are there adequate resources and information distribution channel procedures in place to allow for rapid dissemination? Anyone recall the old “phone trees” where each person calls two other people and before you know it, the entire organization (church, schools, etc…) could get the word out in a timely manner? While the practice was retired with the advent of email and robocalls, perhaps having one on hand could come in handy for internal communications. Baby Boomers and Gen X remember precisely how it works. (You’re welcome.)
Some companies like healthcare systems with their electronic records rely heavily on IT systems to relay health-saving information from lab results to medication orders. Ensuring workaround plans are in place to rapidly communicate and record data is essential in settings such as hospitals. Perhaps annual training or a memo to discuss the company’s or facility’s cyber event response is in order.
Cyber Insurance Coverage
As far too many companies have discovered in recent years, having an insurance policy in place to cover cyber attacks is critical. From ransomware payments to infrastructure equipment failures, having immediate access to capital to cover costs is imperative to getting systems back online.
Stay in the Loop
Keep up with us for lessons learned as we commence our CMMC journey by having The Nucleus delivered directly to your inbox each month.
