Cyber security has been in the headlines more than ever. The reason is that our society's progress is now developing hand in hand with technology and data. We are becoming more vulnerable in digital space. Attackers have gained ground and are a step ahead in offensive operations. Organisations are more often victims of data breaches.
The damage of a cyber attack causes short or long-term losses, erosion of customer trust and brand damage. Threats are changing constantly. New threats emerge every day. Risks come from outsiders and insiders. Companies have to defend against every kind of attack because it just takes one flaw for an organisation's network to be exploited.
The IR plan question
The question is not whether organisations are in danger but how prepared they are to respond to an attack. That depends on the incident response plan.
It is actually a requirement for businesses to have an IR plan. Under ISO 27001 (Information Security Management) and ISO 22301 (Business Continuity), developing a cyber incident response plan is required. An IR plan gives the business a comprehensive step-by-step process to follow when an incident happens.
Ten things an IR plan should address
- Identifying a suspected cyber security incident
- Establishing the objectives of an investigation and clean-up
- Analysing all available information related to the potential incident
- Determining what has actually happened
- Identifying which systems, networks and information have been compromised
- Determining what information has been disclosed, stolen, deleted or corrupted
- Finding out who did it and why
- Working out how it happened
- Determining the potential business impact of the incident
- Conducting forensic investigation to identify those responsible
The writing is on the wall. It is up to you how you equip your team for a fast-changing world.
Originally published 31 March 2017. Migrated to the new IRC site in 2026.