'Cybersecurity Tips for Your Business' is an initiative of the Greater Langley Chamber of Commerce, in partnership with our IT and cybersecurity Chamber members, to bring businesses practical tips, insights, and resources to help keep their operations secure.

Cyber threats are an increasing concern for businesses of all sizes, and even organizations with security measures in place can be vulnerable. By sharing real-world experiences and expert advice from our members, we hope to help local businesses recognize potential risks and take proactive steps to protect themselves.

Read the case study below from Chamber member Comwell Group to learn why an incidence response plan matters and what to include in your incidence response plan.

When Prevention Is Not Enough - Why Every Business Needs an Incident Response Plan

Most businesses spend their cybersecurity effort trying to stop something bad from happening. Strong passwords, multifactor authentication, backups, security awareness training, email protection, and monitoring are all important. But no security measure is perfect. A phishing email can still get through. An employee can make a mistake. A laptop can be lost. A vendor can be compromised. Ransomware can disrupt critical systems. Even a simple technology failure can leave employees unable to work.

That is why every business should be able to answer a second question: If something does happen, what will we do next? 

An Incident Response Plan is the answer. What happens when there is no plan?

Imagine arriving at work and discovering that employees cannot access the company's files. A message on the screen says they have been encrypted. What happens next? Who makes the first call? Do you contact your IT provider, insurance company, lawyer, or police? Should employees shut down their computers? Can they continue using email? What do you tell customers? How do you know whether information has been stolen? And which systems need to come back online first? Those are difficult questions at the best of times. They become much harder when your business is already under pressure. An Incident Response Plan establishes those decisions and responsibilities before the emergency happens.

Why an Incident Response Plan Matters
One of the biggest benefits of having a plan is reducing uncertainty. During a serious cybersecurity incident, several people may need to become involved quickly, including management, IT, legal counsel, the organization's cyber insurance provider, privacy specialists, vendors, and communications support. A good Incident Response Plan identifies who needs to be involved, how to reach them, who has authority to make decisions, and what needs to happen first. It should also identify the systems and services the business depends on most.

For one company, restoring email might be the priority. For another, it could be its accounting system, production environment, dispatch software, customer database, or access to files. Knowing those priorities in advance can make recovery significantly easier.

What Should Be in the Plan?
An Incident Response Plan does not need to be complicated. In fact, a simple plan that employees understand and can find during an emergency is far more useful than a 100-page document nobody has read.

At a minimum, businesses should document:

· Who is responsible for leading the response and who takes over if that person is unavailable.

· Contact information for management, IT support, legal counsel, the cyber insurance provider, and other important vendors.

· The company's most critical systems, applications, data, and business services.

· How a suspected incident should be reported and escalated.

· Who has authority to make important decisions during an incident.

· How the organization will communicate with employees, customers, vendors, and other stakeholders if necessary.

· Where backups are located and which systems should be restored first.

· How actions and decisions made during the incident will be documented.

There should also be a way to access this information if the company's normal technology is unavailable. Keeping an offline copy of the plan and important contact information can make a significant difference if employees suddenly cannot access email, Microsoft 365, servers, or other systems.

Do Not Forget Your Vendors
Your Incident Response Plan should not stop at your own technology. Most businesses rely on outside organizations to operate. Microsoft 365, cloud applications, accounting software, internet providers, payment processors, IT providers, and other vendors can all become important dependencies. Ask yourself what would happen if one of those services suddenly became unavailable. How long could your business operate without it? Is there another way to perform the same function? Who would you contact? And does the vendor have access to sensitive information or systems? A cybersecurity incident does not have to happen inside your organization to affect your business.

A Plan That is Never Tested is Only a Document
Writing the plan is the first step. The next step is finding out whether it actually works. One of the easiest ways to do that is through a tabletop exercise. A tabletop does not involve shutting down systems or launching a simulated cyberattack. Instead, the people who would respond to an incident sit down together and work through a realistic scenario.

For example:
It is 9:00 a.m. on a Monday and an employee reports that files on the company's server will not open. Shortly afterward, a ransom message appears. What do you do?

The team then begins working through the situation. Who takes the lead? Who calls the IT provider? Should computers be disconnected? Can the business continue operating? When should the cyber insurance provider be contacted? Are backups available? Which systems need to be restored first? How will employees communicate if normal systems are unavailable? Who determines whether customers or other organizations need to be notified?

The purpose is not to see whether someone knows all the right answers. The purpose is to discover the questions you have not answered yet. If nobody knows who has the cyber insurance policy number, update the plan. If the emergency contact information is out of date, fix it. If nobody knows which systems should be restored first, establish the priority. If your only copy of the Incident Response Plan is stored on the server that just became unavailable, keep an offline copy.

Finding these problems during an exercise is far better than discovering them during a real incident.

The Takeaway
Businesses should absolutely invest in preventing cybersecurity incidents. But prevention is only part of being prepared. Eventually, every organization should ask: If our protections fail tomorrow, do we know what happens next?

You do not need an enormous cybersecurity team or a complicated response manual to get started. Identify the people who need to be involved, document your critical systems and contacts, decide who has authority to make key decisions, keep the information somewhere accessible, and then test it with a realistic scenario.

Cybersecurity incidents are stressful by nature. The goal of an Incident Response Plan is not to predict every situation that could happen. It is to make sure that when something does happen, your team is not figuring everything out for the first time.