SecurityWise: Steps to take after experiencing a cyber-attack

07 Oct 2021

When a cyber-attack occurs, how your organisation responds can make all the difference in mitigating the damages. In particular, time is of the essence. That’s why it’s vital for your organisation to have an effective cyber-incident response plan in place that specifically addresses key actions to implement immediately following an attack.

During these initial hours, your organisation’s response can help foster business continuity, protect stakeholders, limit legal repercussions and ultimately put a stop to the incident as quickly as possible. Taking steps to quickly contain a cyber-attack or data breach can provide significant financial benefits.

In order to minimise the lasting damage that can often accompany a cyber-attack, employers should consider taking the following steps immediately after an incident occurs:

Start documenting the incident

As soon as an organisation finds out that a cyber-attack is taking place, it should begin documenting what it knows. This should include when and how the attack was discovered, the technology or data impacted by the attack, and any other supporting evidence regarding the event. This documentation should be updated as more information becomes available.

Alert key personnel

Members of an organisation’s cyber-incident response team should be briefed and alerted. This may include IT leaders, crisis communication experts, and legal professionals. These individuals should then begin carrying out their designated roles and responsibilities as outlined in the organisation’s cyber-incident response plan. Inform additional employees if necessary.

Secure all workplace technology

Take any possible steps to secure servers and devices. Take any impacted technology offline, but do not turn devices off, as there could be important evidence available. Launch any backup systems or data required to perform key operations and ensure business continuity (if applicable).

Seek further assistance

Consult a forensic team or law enforcement to begin an in-depth investigation into the cyber-attack. Reach out to insurance brokers to begin the claim process and receive further assistance.

Inform appropriate parties

Develop a plan with crisis communication experts and legal professionals to share relevant details of the incident with organisational stakeholders, shareholders and government agencies (if necessary).

TH March’s cyber insurance offering can form a key part of your defence in the event of an attack. Arranging cyber insurance cover via TH March can go a considerable way to mitigate the risks and threats to your business. Our qualified team will provide a tailored solution, specific to your business type and budget.

 Discover more about the TH March Club benefits

Club benefits

 

Source: TH March