Develop a Crisis Management Plan

Learning Objectives

After completing this unit, you’ll be able to:

• Describe the importance of building a dedicated crisis management team.
  
• List key skills needed to create a crisis management plan.
  

Build a Crisis Management Team

Crisis management is a critical component of any security program in today’s world. Securing an entire business is a tough job primarily because any potential vulnerability could become the next attack point. For this reason, many organizations focus primarily on how to prevent and defend while not focusing enough on institutionalizing crisis management.

Create a Crisis Management Plan

The following aspects are vital to creating a crisis management plan.

• Develop a cross-functional team. The scope of the team includes executive leadership from operations, finance, legal, communication, human resources, and technology.
  
• Call upon third-party experts. Use technical, legal, public relations, and insurance experts during a major crisis to provide unbiased perspectives.
  
• Identify key law enforcement and regulatory contacts. Establish these contacts before a crisis occurs to help things go smoothly when responding to a disaster.
  

• Have a highly detailed plan. Effective leaders think through the details before a crisis occurs, in order to orchestrate individuals with different roles and responsibilities.
  
• Consider alternative communication paths. Savvy leaders consider communication mechanisms that do not rely on the core organizational infrastructure.
  
• Keep hard copies as a backup. This refers to procedures, contacts, and other critical documentation.
  
• Ensure adherence to global regulatory laws. Ensure the organization meets regulations for responding to an incident.
  
• Focus on preparing for a variety of crises. Consider the motivations and objectives of various potential attacks.
  
• Practice regular tabletop exercises. Simulate decision-making and communication processes using a plausible real-life scenario to ensure readiness.
  
• Have a plan for public communication. If the organization doesn’t communicate, others will, and many “experts” will be happy to speculate.
  
• Retain vigilance during business downtime. Breaches often occur during these periods (for example, outside office hours, during the holiday season).
  
• Avoid overreliance on technology. When responding to a crisis, systems and communications may not be available. Plan for alternate resources.
  

As you prepare your crisis management plan, keep in mind that timeliness is as important as transparency. Showing your customers that you take their privacy and security seriously and responding in a timely, transparent manner can retain customers and protect the organization’s reputation even in the face of adversity. Keep in mind that communications should be simple, give clear instructions to customers about next steps, and help guard against further exploitation by malicious actors. Make sure your customers know how to distinguish legitimate communications from fraudulent ones, and provide alternate verification methods, such as a phone number they can call for more information.

Sum It Up

In this unit you’ve learned more about how and why organizations should put in place a crisis management plan. You’ve learned how to leverage cross-functional teams, document communication and management processes, and put in place backup communication channels. Now that you understand more about how to manage a crisis, let’s learn about planning to recover from a natural disaster or cyberattack. 

Resources

• PDF: NIST: Contingency Planning Guide for Federal Information Systems
  
• PDF: NIST: Computer Security Incident Handling Guide
  
• External Site: SANS: Incident Handler’s Handbook