According to major cyber security readiness reports, 62 percent of organisations have acknowledged that they were breached. Being prepared for a cyber security breach is not about if but when. Given the when-not-if mindset, executive teams need to be proactive.
A good IR plan is the most important roadmap in the moment of crisis. It is tailored to the company's industry and fine-tuned through tabletop exercises. The plan must not become another document sitting in an executive's drawer. A well-rounded IR programme includes regular tabletop exercises that test the plan against realistic scenarios.
Most multinationals have IR plans without a well-developed programme to train against them. In many cases the documentation is out of date, inaccessible to key decision makers, or generic. The result is an ineffective response that damages the brand and breaks stakeholder trust.
A well-prepared IR plan defines all breach scenarios and their specific response steps. It specifies response priorities, stakeholders, roles and responsibilities. It includes templates of internal and external communications.
Eleven principles for an effective IR plan
- Identify the internal IR team. Find who in each department plays a key role and describe what they do.
- Identify the leader of the IR team. The last thing you want in a crisis is to start identifying who is responsible.
- Categorisation. Develop a simple structure for classifying incidents by severity and urgency. This drives C-suite involvement and the level of engagement of the team.
- Response protocol. A framework should include preparation, identification, assessment, communication, containment, eradication, recovery, post-incident.
- Third parties. List key external partners: privacy counsel, forensics, crisis communications.
- Notify and assemble the IR team. After the breach occurs, notify the team in a timely manner. Senior management should be in the response team. Daily progress calls should be scheduled where severity warrants.
- Identify and fix the issue. Run analysis to identify the incident and develop a containment plan. After fixing, identify the full nature and extent of the attack.
- Let the facts drive decisions. Collect forensic data (hardware, devices, database activity) to a safe location for analysis. Build the timeline around incidents and response.
- Determine legal obligations. Experienced counsel can quickly and accurately assess privacy, security laws and regulations that may apply to the breach.
- Communicate. Constant communication among IR team members. Outside counsel should be involved in the communications plan to preserve privileges. Prepare a holding statement for executives.
- Eliminate fragments and recover. Once the threat is eradicated, restore assets and return to normal operations.
Developing a robust plan is challenging and time-consuming. Facing a cyber security breach without one is far worse. When a breach comes to light, the first question customers, shareholders and regulators ask is: "What did the business do to be prepared to respond to a breach?"
Originally published 9 March 2017. Migrated to the new IRC site in 2026.