While the first priority should of course be to prevent cybercrime, it is equally important to have a plan — along with the proper insurance policy — to respond if a breach occurs. Depending on the circumstances, the response itself can either make a bad situation worse or preserve a business’ positive public perception.
In the event of an incident, a cyber liability insurance carrier can work alongside a company to solve the problem and cover insured costs related to these vital steps:
Triage
Understand the problem. If data, such as customer or employee personal information, was stolen, how many individuals were impacted and what kind of data was it? Did the incident trigger a state or federal requirement to disclose or otherwise report the event? How did the theft occur — email scam? Malware? Is there a ransom demand? Is the threat active? Should systems or processes be suspended? Are systems even accessible?
A company’s IT team or third-party vendor should be able to answer these questions. Additionally, if a business has the bandwidth to support it, an internal committee devoted to cybersecurity should meet often — including before an attack — to plan and decide the way forward for the organization.
Businesses that successfully respond and quickly recover from these events routinely test their response protocols and train employees. Luck favors the prepared, and investments in cybersecurity can strengthen an organization's ability to recover from cyber incidents.
Communication
Especially when customers are personally or professionally impacted by an event, transparent communication will be vital to retaining trust and continued business. Moreover, applicable state and federal requirements specify certain disclosures and government reporting of cyber incidents.
Cyberattacks can be complex and difficult to resolve as fast as the public may like, so even if a business cannot share sensitive details in the short term, it can communicate about its processes and controls. Is an investigation in process? What is the company doing to prevent further harm? How will customers be affected, and how will they be compensated for any losses? This is a chance to explain how the business is proactively rectifying the situation. Having an at-the-ready communications plan will accelerate the recovery and limit reputational damage.
Repair
It’s the most important piece of the process — solving the problem. If there is a data breach, the company’s IT team or vendor should have preexisting protocols to contain it and mitigate immediate damage. For example, employee passwords may need to be reset, internal systems rebooted and the customer base informed of any steps they will be required to take.
If it’s a ransomware event and systems fail, it may take weeks or months to determine critical data loss, and even if the ransom is paid, there is no guarantee all the data will be returned, unencrypted or made available. Consider the “3-2-1 rule” — three different immutable copies of important data, with two different storage means (i.e., cloud vs. tape), and one copy held offsite or offline.
Law enforcement also plays a role in the process. Contact the authorities as soon as the breach is identified because cybercrime experts can assist in resolving the situation and perhaps identifying the fraudster(s).
