Cyber incidents can cause operations to be impacted, sensitive data to be exposed, and result in substantial financial and reputational risks. To have an effective incident response plan means that an organisation has a structured approach to identifying, containing and recovering from security incidents. But just having a document isn't enough. When a real incident occurs, confusion may result from poor planning.

Failing to Define Clear Responsibilities

A frequent error is developing response plan without clearly designating responsibilities. Staff should be aware of who is responsible for investigation, containment, communication and recovery during a security incident.

Important roles should be identified and those who have authority to make important decisions should be established in the plan. This helps avoid duplication of effort and delays, if any, if a rapid response is needed.

Creating a Plan That Is Too Complicated

The incident response plan should be robust enough to be of assistance, rather than confusing. Very technical / lengthy procedures may make it difficult for employees to access the information they require in an emergency.

Clear language and organisation of procedures based on various incident scenarios may make the plan easier to follow and understand.

Not Using a Practical Checklist

The other error is using generic advice but not giving steps. Teams should use a cyber incident response checklist to help them follow steps in a logical sequence.

The checklist can include initial detection, incident assessment, system isolation, evidence preservation, internal communication, recovery and post-incident review. Maintaining these steps can assist teams to respond more consistently.

Forgetting to Test the Plan

A plan that has yet to be tested will have a number of unknowns until it is tested during an actual incident. Exercise to check the understanding of responsibilities and if communication is working as intended within organisations should be conducted regularly.

Teams can conduct tabletop exercises and hold simulated scenarios to detect weaknesses without a real attack occurring.

Failing to Keep the Plan Updated

The technology, business processes and cyber threats are constantly evolving. Contact details, systems, applications and responses procedures can easily become out of date.

The plan should be revised regularly and updated when there are major changes in the technology or security environment within the organisation.

Overlooking Specialist Guidance

Other organizations might not have a separate cybersecurity leader or internal expertise to create an in-depth response plan. Collaborating with a Virtual CISO can be an effective way to get some seasoned security leadership without the need of hiring an executive.

A Virtual CISO can assist in the review of current procedures, determine gaps, set up response processes and facilitate regular testing.

Build a Plan That Works in Practice

The response plan should be practical, easily accessible by the appropriate persons, and regularly tested. Removing ambiguity about who is responsible, complexity, obsolete data, and inadequate testing will help to make organisations more cyber-ready.

A well-maintained ‘incident response plan' does not remove cyber risk; rather it can assist cyber teams to respond in a more organised and timely fashion should and when a security incident arise.