The Ponemon Institute’s 2017 study on the cost of a data breach showed companies have a one in four chance of experiencing such a breach within a two-year period. In my experience working in the cybersecurity industry, I’ve seen the damage a breach can inflict firsthand. And unfortunately, this unsettling trend will continue for the foreseeable future.

Far too often, companies are more concerned about the incident itself: How did it come to fruition? How long will it last? Where did it start? The questions are seemingly endless. While these are valid concerns, the breach is only the beginning of the trouble.

It’s what happens after a data breach that causes most companies to falter. The extent of the damage largely depends on the organization’s preparedness level. According to the Ponemon study, one of the most effective ways to reduce the cost of a data breach is to implement a cybersecurity incident response plan (CSIRP).

GDPR Regulations Impact the Cost of a Data Breach

The General Data Protection Regulation (GDPR), which goes into effect on May 25, requires companies to notify users of a data breach within 72 hours. With significant financial penalties at stake, it is even more critical to develop and test your CSIRP before a breach occurs. When you’re dealing with your company’s brand and reputation, the worst time to find out your CSIRP is flawed is in the middle of an emergency.

A CSIRP is a road map to guide your response to a cyberattack:

• It defines the roles and responsibilities of all respondents.
• It determines who is authorized to make major decisions.
• It outlines communication flows and notification procedures pertaining to GDPR.

A comprehensive CSIRP — that is regularly tested and updated — can help incident response teams save valuable time and resources in the event of a breach.

Learn more about intelligent threat prevention and incident response

Building a CSIRP to Contain the Damage of a Breach

The IBM X-Force Incident Response and Intelligence Services (IRIS) team has worked with hundreds of clients to prepare for and respond to security incidents. IRIS consultants have found that nearly 50 percent of the CSIRPs they’ve evaluated show no evidence of a formal document life cycle or a history of continual revisions.

IRIS experts are noted for investigating some of the world’s top security incidents. In helping clients respond to declared incidents, these experts have observed what works well in a CSIRP — and what doesn’t. IRIS can help clients evaluate and improve an existing CSIRP or build a custom plan from the ground up. It can also help security leaders develop custom tabletop exercises to test their strategy.

In the event of an incident, it’s critical to answer three key questions: What has happened? What data have the attackers accessed? How can the damage be quickly contained and remediated? A robust incident response plan is absolutely crucial for getting these answers — especially given the strict data privacy regulations coming into effect this year.

Learn more about intelligent threat prevention and incident response