Reveal, Reframe, Rethink, Recover – Do you have a Cybersecurity plan?

This year we flagged in our 2022 Trends post that teams need to consider what will happen when (not if) your company faces a breach of privacy or cybercrime issue.   That had clients asking about what steps to take to review their own processes and ensure best practices.  While this can take place as part of a stand-alone review, given the pace of technology change many are wanting to embed the discussions into their annual risk assessment reviews to increase preparedness for the changes ahead.  Here’s the framework we use to support these conversations.

1. Reveal – Teams should ensure they identify the underlying assumptions they have and processes/expertise already in place.
   • Where is our customer data stored?
   • Who has access?
   • What protections do we have in place?
   • What past issues have we experienced? Has our server ever been hacked? Our social media accounts?
   • What future threats do we expect?
2. Reframe – As we explore expected, preferred and alternative future scenarios, teams can identify what would lead them to a new / preferred future state.
   • What risks have we identified?
   • What new preventative measures or backup processes  have we identified?
   • What new measures should we ensure our third-party vendors have in place?  What new laws or best-practices should we be discussing with them?
   • What recovery routes offer the most potential? Are most likely?
   • What additional resources / expertise might we consider?
3. Rethink – Teams can now develop a plan of action that enables everyone to collaborate and continuously improve their processes.  Plans provide clarity on who can provide expertise, support and who is responsible for final decisions if issues arise.
   • Update our response plans
   • Ensure teams are familiar with these plans and know how to reprioritize should an event occur or what to do if someone is on vacation
   • “teams” should also include third-party vendors / databases – what steps do you need to take if a security breach takes place there?
4. Recover – As we highlighted in our 2021 trends post, the average time to identify a data breach was 168 days and the average time to contain a data breach was 58 days.  Then it can take months to fully recover. Ensuring teams are planning for not only the initial response but on recovering trust and following up to rebuild brand loyalty will be key.
   • An essential part of any response plan is to over-communicate!

Resources: https://cyber.gc.ca/en/guidance/baseline-cyber-security-controls-small-and-medium-organizations