… develop a cybersecurity incident response plan.

Cyberattack Response Programs are documented crisis plans and policies designed to help organizations respond to both internal and external security incidents such as distributed denial of service (DDoS), malware, phishing or ransomware attacks and data breaches that could include information theft or system downtime. IT managers must identify the severity, legitimacy, scope, length, source and location of an attack as well as the data or IT resources threatened and attacker motivations all while maintaining organizational operations and informing senior management of an attack’s impact on business or customers.

Attack response plans are a critical piece of all IT security, business continuity and disaster recovery programs. They establish clear metrics and measures that organizations must follow to reduce cyber-attack impacts including lost productivity, non-compliance and IP theft from either external threats or malicious insiders. A proper plan and response should emphasize attack readiness from an IT perspective, business agility through fast response times and executive support as well as adaptability in communicating business impacts and mitigation decisions to key stakeholders.

For effective attack planning and responses, multiple business functions and skill sets must be coordinated so that an incident does not escalate to crisis levels. Components of cyber-attack response plans include attack response team member identification, and role and responsibility assignments, as well as information sharing guidelines, detailed incident response process steps and notifying insurance carriers or law enforcement, if necessary.

Cyberattack Planning and Response

After an attack response plan is in place, team members should regularly conduct mock incident drills and address hypothetical attacks to reveal plan gaps that need improvement. Effective attack response preparation encompasses the crisis management lifecycle of “Readiness, Response, and Recovery” as detailed below:¹

Readiness. Readiness may include IT solutions in place such as network monitoring or identity and access management systems plus team and organizational resource readiness to deal with cyber-attacks and their outcomes. Attack drills can help senior management understand cyber-attack methodologies and impacts from an operational and financial perspective as well as steps that must be taken to achieve overall organizational readiness against a cyber-attack.

Response. Attack response means containing or escalating an attack to reduce reputational damage, lost customers, operational business disruptions and accounting for recovery costs. Management should also be ready to communicate to employees and stakeholders that the organization’s response is adequate to ensure business continuity and disaster recovery.

Recovery. Returning to pre-attack business operations and limiting organizational damage to stakeholders is a critical piece of recovery from a cyber-attack. Recovery tactics include implementing disaster recovery procedures that mitigate threats and secure critical business data, and working with insurance carriers to assess damage or law enforcement to determine if legal action must be taken.

Technical Framework Attack Response Service

Attack response programs are an essential piece of all organizational IT governance and compliance strategies that minimize incident damage, downtime, and organizational losses. Technical Framework offers comprehensive attack response services that include custom program design, readiness, response and recovery. Technical Framework also implements and maintains attack response best practices to help clients ensure their IT security, governance regulatory compliance in disaster response and recovery scenarios.