What to decide before a cyberattack happens

Why decide in advance

During an attack, people are stressed, systems may be down and every hour counts. Decisions made in a hurry, like wiping computers before anyone has looked at them, paying quickly or telling clients the wrong thing, can make it worse. A plan made calmly beforehand avoids most of that.

What it covers

• How to recognize and report an incident, and to whom. Everyone should know the first call.
• Who is in charge: one person who makes decisions, with a deputy.
• Who to call: your IT provider, your bank, your insurer and a lawyer, with numbers stored outside company systems.
• First steps: disconnect affected computers from the network but leave them switched on, and preserve evidence.
• Communication: what staff are told, what clients and suppliers are told, and who speaks for the business.
• Legal and reporting duties: some incidents must be reported to authorities or affected people within set times. Your lawyer or insurer will advise.
• Recovery: how systems are restored, in what order, from which backups.
• Afterward: a review of what happened and what to change.

Keep it alive

Print it. Check the phone numbers every few months. Walk through a scenario once a year with the people named in it. A plan only helps if people know it exists.