Share

5 Ways an Incident Response Plan Helps Mitigate a Cyberattack

With high-profile cyberattacks in the news, the importance of creating and maintaining an incident response plan in the event of a cyberattack on your organization cannot be understated. An incident response plan is a tailored guide of instructions that includes guidance such as defining the roles, responsibilities, policies, and protocols of the response team in the event of a cyber-related incident. The Plan should include, at a minimum, protocols over the following phases of responding to a cyber incident:

Planning

The roles of the response team should be established and clearly defined before an incident were to occur. This includes appointing a leader to own response efforts and assigning responsibilities, such as media and law enforcement communication to individual team members. Additionally, employees should be trained on how to detect and report incidents and should be informed on proper procedures in the event of an attack.

Detection

An attack has occurred, and now the response team must work to understand its severity and impact. This involves determining what kind of attack it was, what systems were affected, what data was impacted, and what risks are posed to continued business operations. Steps should be taken to begin reporting the incident to the proper stakeholders as laid out by the Plan, which may be a mix of customers, vendors, regulators, and others. This should include notifying customers of the potential breach of their data and disclosing the incident through proper channels as needed (such as disclosure to the SEC as required for publicly traded companies), once enough data has been collected on the details surrounding the incident.

Isolation

The attack has been identified, and now it must be isolated and expunged. This is the process of restoring normal operations and preventing further damage through the removal of affected files or systems, the retrieval of lost data from backups, and verifying that the attack has been stopped and any intruders have been removed from your systems.

Post-attack review

Now that the attack has been stopped and business operations have been restored, the response team must review its actions and identify what went well and what needs to be improved in their Plan. Additionally, the weaknesses made apparent by the attack should be addressed along with investigating what actions could have been taken to prevent it.

Why is an Incident Response Plan Important?

1. Improves security and readiness. Identification of weaknesses in the preparation for an incident and the implementation of preventative measures can reduce the likelihood that a future attack will have damaging effects on business operations.
2. Reduces financial losses and legal liability. With quicker response times from an organized response team, infiltrations and attacks will be far less reaching and damaging. Clearly defined communication protocols will also facilitate complying with obligations to report data breaches.
3. Safeguards business reputation. By dealing with a cyberattack efficiently and transparently, organizations maintain their customers’ trust and loyalty while also reducing the damage done to customers’ data.
4. Strengthens market position. The ability to cope with a cyberattack is an opportunity for businesses to demonstrate their leadership in a particular industry. Customers will prefer a business that can mitigate and recover quickly from a cyberattack when compared to competition that cannot. This issue was a driving force behind the new SEC Incident Response Cybersecurity Disclosure Requirements to provide investors greater visibility into publicly traded companies that suffer cyber incidents and the potential adverse effects on the companies’ financial position.
5. Increases stakeholder engagement. Involving partners, suppliers, regulators, and other parties who may be affected by the incident response efforts can improve communication with stakeholders and foster increased trust.

How Centri Can Help

The costs of a cybersecurity incident are too high to be ignored. At Centri, our IT risk and cybersecurity advisory services are designed with your greatest assets in mind — your people. We’re here to offer you the support, resources, and expertise you need, exactly when you need it most. Contact us to find out how we can set your business up for success.

Rich Sowalsky

Partner | Risk Advisory Practice Leader | CISA

Rich is a Partner at Centri Business Consulting and the leader of the firm’s Risk Advisory Practice. He has more than 17 years of combined experience in risk & internal control consulting, internal audit, IT risk & cybersecurity advisory, Sarbanes-Oxley (SOX) 404 Compliance, Enterprise Risk Management, financial reporting & accounting. He joined Centri in February 2022 and has provided a variety of risk advisory and compliance services for clients across various industries, including insurance, digital assets & fintech, life sciences, financial services, healthcare, technology, and more.. View Rich Sowalsky's Full Bio

Karyn DiMassa

Managing Director | CPA, PMP, CISA, CFE

Karyn is a Managing Director in the IT Risk & Cybersecurity Practice at Centri Business Consulting. She has more than 15 years of combined experience in internal IT audit and external audit support (IT controls), third-party assurance (SOC 1 and SOC 2 reporting), internal controls consulting, project management, IT risk and cybersecurity, and system implementation support. View Karyn DiMassa's Full Bio