Incident response planning, including tabletop exercises, is vital to the data breach preparedness of any organization. Data breaches can have a crippling effect on a business. Although data breaches at large companies dominate the headlines, data breaches occur at small and medium-sized businesses as well. To properly prepare for a data breach, a company should create an incident response plan, and test that plan through tabletop exercises.
What is a data breach tabletop exercise?
A data breach tabletop exercise is an exercise that simulates an actual cyber incident. It takes participants through the process of dealing with a simulated incident scenario. Some examples include a network malware infection, a stolen laptop, or a ransomware attack. A tabletop exercise will allow your incident response team to practice its incident response plan. It will also allow your company to evaluate its incident response plan and identify areas of improvement.
How do you conduct a data breach tabletop exercise?
- Identify Who is involved: When conducting a tabletop exercise all of the key players identified in your incident response plan should be present. This group may include executives, HR, IT, legal and outside vendors.
- Identify a scenario: The variety of cyber threats in today’s world provides any number of plausible scenarios to choose from. You should attempt to identify a scenario that you believe may actually threaten your business in the future in order for the exercise to have the greatest impact.
- Respond to the scenario: Actually, working through your incident response plan will be the bulk of the exercise. The participants should go through the incident response plan step-by-step. They should be encouraged to talk through their thinking and explore different actions and the potential consequences of different responses.
- Review/Assess: Following the completion of the exercise, the incident response team should review the incident response. The group should identify things that were done well, and also identify areas that need improvement. The company’s incident response plan should then be updated to reflect the lessons learned from the exercise.
Incident response planning is one of the most important parts of data breach response. Without an incident response plan that has been properly tested, it will be difficult to properly respond to a data breach.
If you need assistance developing an incident response plan, and/or conducting a tabletop exercise, please contact Tim Hayes at McKenna Storer.