They also know that while a crisis is occurring, and in the minutes and hours that follow, is not the time to be thinking about the status of their recovery plans and response plans. Using that time most-effectively is critical to a successful recovery. Research has shown that those companies that have prepared for the inevitable cyber crisis are more likely to recover completely and avoid long term negative impact.
Leaders need to actively manage their business resiliency as a core governance, risk and compliance concern to avoid surprises that could lead to a business interruption, resulting in lost revenue and damage to the organization’s strength and reputation.
Is your organization prepared for a crisis? Start by asking yourself these five crisis preparedness questions:
Have you considered all potential crises and the impact each could have on your business operations?
Could your systems be recovered? Have you identified alternative supply chains to avoid single points of failure?
How will you inform employees and external stakeholders? Do you have a spokesperson? Is that individual prepared to speak to the media? Do you have a list of standard questions that you’re prepared to answer, regardless of event?
Have you tested it? Just like fire drills prepare us for real fires, crisis plans need to be regularly tested. Ask yourself if it makes sense to spend thousands, maybe even millions, of dollars on a plan that you don’t know for certain will work.
The 2014 State of Risk Report commissioned by Trustwave found that more than 20 percent of companies don’t have incident response plans. Of those that do, the same number never test them — leaving their organizations open to risk. Like any other company processes or procedures, your plan should be a flexible document that is periodically tested and revised to continue to meet your needs.
You can also read about how Old Line Bank worked with Hartman to develop an enhanced information security program and trained senior leadership on ways to handle issues of cybersecurity.