Questions to ask your IR team

When a security breach happens, you need a clearly defined incident response plan to effectively identify, investigate, and respond to the incident.

Like a fire-drill, a predetermined plan can help cut through the chaos if the worst happens.

Start by asking your team the below questions, which will help them develop and implement an incident response process that is relevant to your business.

• What types of events are considered incidents?
• Who identifies an incident?
• How is an incident identified?
• What is the acceptable interruption window?
• Who is the incident manager during an incident?
• Who are the organization’s incident response team members?
• How will these team members collaborate during the incident?
• Who is the IR escalation contacts?
• What is the internal communication plan?
• What are the extended communication plans with providers?
• What is the alternative communication plan if the attack disables regular means of communication (email, phone, conference bridge availability)?
• What types of information does the company have and what are the disclosure requirements for each type?
• When is the legal team involved and who makes that decision?
• Is there a mechanism for the internal IR team, partners, vendors, and legal to collaborate effectively and manage the different work streams in the event of an incident?

We offer expert strategic and technical incident response services as well as a collaboration platform that allows for the most effective management of a security incident across multiple stakeholders both internally and externally. For more details speak to one of our experts.

Download your IR Datasheet here.