A robust cyber incident response plan will minimize both damages and recovery time and ensure business continuity.

Proactive measures to defend against data breaches, malware, social engineering, and other cyberattacks are crucial to enterprise cybersecurity, but there’s no such thing as a completely impenetrable system. Despite your best efforts, your company could still be hacked; do you know what to do if that happens? A cyber incident response plan gives organizations a specific set of procedures to follow after a cyberattack, allowing security teams to respond faster and more effectively.

Unfortunately, many organizations either don’t have cyber incident response plans or have ineffective ones that aren’t clear, specific, or current. Here are five tips for developing an effective plan.

Begin with a current risk assessment

One of the most common shortfalls in cyber incident response plans is that they don’t address the specific risks the enterprise faces right now because they are developed using out-of-date or incomplete information. Be sure to conduct a thorough risk assessment before putting a plan together. Because both enterprise data environments and the cyber threat landscape are dynamic, you’ll need to conduct periodic reassessments and adjust your incident response plan accordingly.

Don’t develop your plan in a silo

According to research by McKinsey, incident response plans are often developed in organizational silos, where individual departments or business units prepare plans to mitigate targeted attacks. Unfortunately, this leaves the organization unprepared for an attack that spans multiple business units or even the entire enterprise. Make sure that all company stakeholders work together on incident response, and that the procedures address both types of attacks.

Clearly identify your stakeholders and their roles and responsibilities

Depending on an organization’s size, quite a few people can be involved in cyber incident response, from IT and security staff to legal and public relations personnel. Who is the incident commander? Who has the authority to take systems offline? Who notifies victims in the event of a breach, and how? Who handles press inquiries? Make sure that your plan specifies who is involved and what their responsibilities are.

Clearly define incident types and thresholds

Different types of attacks require different countermeasures. A high-risk or critical incident might warrant the full or partial shutdown of a system, but doing this would be overkill for a low-risk incident. Incident response plans should include a quantifiable method to classify cyber incidents according to severity.

Outline clear, specific procedures

Each incident classification category must be attached to clear, specific procedures outlining, in detail, what each stakeholder needs to do as part of the incident response. This includes internal reporting and documentation, investigation, containment and eradication, and recovery. Make sure the procedures outline when external parties, such as law enforcement, government regulators, outside legal counsel, and cyber insurers, need to be involved.

Developing a comprehensive cyber incident response plan is well worth the time and effort to minimize damages and ensure business continuity. According to the Ponemon Institute, companies that contain data breaches within 30 days can save over $1 million in recovery costs.

The cybersecurity experts at Continuum GRC have deep knowledge of the cybersecurity field, are continually monitoring the latest information security threats, and are committed to protecting your organization from security breaches. Continuum GRC offers full-service and in-house risk assessment and risk management subscriptions, and we help companies all around the world sustain proactive cybersecurity programs.

Continuum GRC is proactive cybersecurity®. Call 1-888-896-6207 to discuss your organization’s cybersecurity needs and find out how we can help your organization protect its systems and ensure compliance.

The DoD unveiled its proposed Cybersecurity Maturity Model Certification (CMMC) to prevent supply chain attacks

Cyberattacks on the U.S. government’s vast network of contractors and subcontractors pose a serious threat to national security, and the DoD is taking action. The agency tasked NIST with developing a set of guidelines addressing advanced persistent threats against contractors who handle high-value data assets, and it recently unveiled plans for its own set of standards, the Cybersecurity Maturity Model Certification (CMMC).

What is the CMMC?

The CMMC will be developed in partnership with Johns Hopkins Applied Physics Lab and Carnegie Mellon University Software Engineering Institute. The goal is to combine a number of existing cybersecurity control standards, such as NIST 800-171, NIST 800-53, ISO 27001, ISO 27032, and FedRAMP, into one unified standard.

In addition to assessing a contractor’s implementation of controls, the CMMC will also assess the maturity of the company’s institutionalization of cybersecurity practices and processes. Assessments will be conducted by third-party auditors, and companies will receive a score indicating the maturity and sophistication level their controls. There will be five CMMC levels, ranging from “Basic Cybersecurity Hygiene” to “Advanced.”

The DoD has indicated that the CMC will be a dynamic framework so that it is able to adapt to new and emerging cyber threats. A neutral third party will be responsible for maintaining the standard.

How will the CMMC affect DoD contractors?

DoD prime contractors have been held to higher cybersecurity standards since 2017, but typically, those primes outsource some of their work to subcontractors, who then have subcontractors under them. It’s these contractors, at tier two or below, that the CMMC is primarily aimed at. Many times, they are small companies that do not have robust cybersecurity defenses, which is why hackers target them. However, while the DoD has stressed that all areas of the federal supply chain must be secured, they have not yet gone into specifics regarding how the CMMC will flow down to subcontractors.

The DoD wants to implement CMMC in January 2020, include CMMC level requirements in RFIs by June 2020, and include them in sections L and M of RFPs by September 2020. CMMC levels will be used as a “go/no-go decision.”

The CMMC level required will depend on the nature of the CUI (controlled unclassified information) the contractor will be handling or processing. However, all companies conducting business with the DoD will be required to be CMMC certified, even if they do not handle CUI.

Recognizing that smaller subcontractors may be on tight budgets, the DoD is striving to make CMMC certification affordable. Additionally, IT security will be an allowable expense on contracts moving forward, so companies can modify their rates to reflect the new standards.

Getting ready for the CMMC

The DoD is conducting a “CMMC Listening Tour” to solicit feedback from defense contractors; sessions are currently scheduled through August.

Early preparation for the new requirements will be the key to success. Now is the time to reevaluate your data environment, cybersecurity policies and procedures, and compliance processes. Since the CMMC will be partially based on NIST 800-171, ensuring that your company meets at least those standards will make the CMMC certification process smoother.

The cybersecurity experts at Continuum GRC have deep knowledge of the cybersecurity field, are continually monitoring the latest information security threats, and are committed to protecting your organization from security breaches. Continuum GRC offers full-service and in-house risk assessment and risk management subscriptions, and we help companies all around the world sustain proactive cybersecurity programs.

Continuum GRC is proactive cybersecurity®. Call 1-888-896-6207 to discuss your organization’s cybersecurity needs and find out how we can help your organization protect its systems and ensure compliance.