Building a cyber response team

While there’s a lot of media attention around major data breaches that impact multinational companies, hospitals, and universities, small and mid-sized businesses are also prone to attacks — and they often have fewer defenses in place than their larger counterparts.

Whether it’s malware that takes down your website, ransomware that holds your data hostage, or a breach that exposes your customers’ private information, an attack can sideline your business — and it will cost you to get back up and running.

Despite this, many small business owners overlook the risks or don’t believe they need coverage for cyber risks. Or they may mistakenly believe they’re covered under their current umbrella policy.

But not having a security strategy — and not having adequate coverage — comes at a high price. Upon discovering a cyberattack, you’ll need to quickly activate your incident response plan to minimize disruption to your business and enable recovery.

The consequences could also be long-lasting. For example, even if you regain access to stolen data, you’ll still need to deal with things such as network repair, legal claims, and more — and this could take days, weeks, or months.

How to get started

When it comes to a cyber response strategy, many business owners don’t know where to start. The Canadian Centre for Cyber Security offers cyber security controls for small and mid-sized businesses, such as developing an incident response plan, automatically patching applications, enabling security software, securely configuring devices, and using strong user authentication — to name just a few.

While cyber security controls are important, so is having a cyber incident response program, which includes a set of security policies, controls, and processes that can help your business protect against cyber risks — and respond to and recover from incidents due to said risks.

Even if you don’t have a cyber security expert on staff, it’s important to put a cyber response team together and map out roles and responsibilities. The team should be small, so it can be nimble in the event of an incident (you can always add more members as needed in different lines of business).

Small and mid-sized businesses that don’t have in-house resources may want to expand their team by bringing in external parties in areas such as IT support, legal support, human resources, and media relations.

If you might need help from external parties, such as forensic specialists and security consultants, know who these people are ahead of time and how to reach them in an emergency. You’ll also need to budget for that.

The team should also designate a team leader. For example, if you’re the victim of a ransomware attack, who is the person in charge of handling the response? Do they know what to do and who to call? Do they have contacts with legal counsel, law enforcement, and forensic specialists? Do they know who to contact at their insurance brokerage?

Key stakeholders should also be empowered to make in-the-moment decisions. For example, a cyber response team member in the finance department can be empowered to make quick budgetary decisions if it’s necessary to bring in a forensic specialist or other experts during a security breach.

Why cyber insurance plays a key role

Cyber insurance should be part of your cyber response strategy, and your insurance broker should be part of your cyber response team. Cyber insurance is designed to support your business if you suffer a breach that causes business interruption, corruption to computer systems, or data to be stolen or ransomed.

Cyber risk coverage can involve:

Business interruption
Incident response
Data recovery
Third-party liability
Fines from privacy regulators

Without the right coverage, incident response and remediation costs, business interruption, and legal fees and fines that come with a cyberattack could fall on your shoulders.

Protect yourself with the right insurance

You simply never know what could happen in the digital world, so ensuring your business is protected and covered in the event of a loss is imperative. Beyond the financial ramifications, security and data breaches can severely impact your reputation with your clients and customers. To learn more about protecting yourself and your business, visit our cyber risk insurance page today.