Have staff roles and responsibilities, in the event of a cyber security crisis, been clearly outlined and understood? Is your company spokesperson qualified and adequately prepared (e.g., media trained) to handle a crisis?

Do not panic. Call everyone together. Find out the nature of the incident.
Legal counsel should be prepared to carefully review the method and content of any communications in order to identify any potential issues.
Use of external legal experts is highly recommended.

Do you have contacts at specialist crisis communications firms in the event you need their services?

In selecting a crisis communications firm, you should consider whether the firm is knowledgeable of your industry, experienced in handling the type of events and constituents anticipated by your plan, and capable of speaking to the media on your behalf, as necessary.
Many outside experts tend to prey upon companies that are victims of security breaches, knowing the management wants to do the right thing quickly to stay in compliance with the ever increasing number of regulations and statutes. Let your outside legal experts or your insurance carrier negotiate this agreement. They are more objective.

Do you have a system in place to quickly determine who should be notified, and a process for notifying the appropriate individuals (e.g., customers, employees) in case of a security breach? Do you know what contact methods you have available—mailing addresses, email addresses, or home phone numbers? Are you aware of the legal requirements regarding notification to individuals regarding loss of sensitive information?

Because state laws may require prompt notification, it is important to determine in advance how individuals will be contacted.
Understand your obligations under all the applicable statutes and regulations. Consult with outside legal exerts. They can help you understand what your timelines are for reporting.
Immediately consider the size of the affected population impacted and the risks from exposure, all data elements exposed, and the predicted response of the affected constituents.
Communicate accurately and as soon as practical. Appoint a single company spokesperson. Be honest, direct, and contrite. Let your actions mirror your words.

Special Reports /

You've Suffered a Cyber-Security Breach—How Will You Respond?

Related Stories

Recommended For You