The Ponemon Institute’s 2017 study on the cost of a data breach showed companies have a one in four chance of experiencing such a breach within a two-year period. In my experience working in the cybersecurity industry, I’ve seen the damage a breach can inflict firsthand. And unfortunately, this unsettling trend will continue for the foreseeable future.

Far too often, companies are more concerned about the incident itself: How did it come to fruition? How long will it last? Where did it start? The questions are seemingly endless. While these are valid concerns, the breach is only the beginning of the trouble.

It’s what happens after a data breach that causes most companies to falter. The extent of the damage largely depends on the organization’s preparedness level. According to the Ponemon study, one of the most effective ways to reduce the cost of a data breach is to implement a cybersecurity incident response plan (CSIRP).

GDPR Regulations Impact the Cost of a Data Breach

The General Data Protection Regulation (GDPR), which goes into effect on May 25, requires companies to notify users of a data breach within 72 hours. With significant financial penalties at stake, it is even more critical to develop and test your CSIRP before a breach occurs. When you’re dealing with your company’s brand and reputation, the worst time to find out your CSIRP is flawed is in the middle of an emergency.

A CSIRP is a road map to guide your response to a cyberattack:

  • It defines the roles and responsibilities of all respondents.
  • It determines who is authorized to make major decisions.
  • It outlines communication flows and notification procedures pertaining to GDPR.

A comprehensive CSIRP — that is regularly tested and updated — can help incident response teams save valuable time and resources in the event of a breach.

Learn more about intelligent threat prevention and incident response

Building a CSIRP to Contain the Damage of a Breach

The IBM X-Force Incident Response and Intelligence Services (IRIS) team has worked with hundreds of clients to prepare for and respond to security incidents. IRIS consultants have found that nearly 50 percent of the CSIRPs they’ve evaluated show no evidence of a formal document life cycle or a history of continual revisions.

IRIS experts are noted for investigating some of the world’s top security incidents. In helping clients respond to declared incidents, these experts have observed what works well in a CSIRP — and what doesn’t. IRIS can help clients evaluate and improve an existing CSIRP or build a custom plan from the ground up. It can also help security leaders develop custom tabletop exercises to test their strategy.

In the event of an incident, it’s critical to answer three key questions: What has happened? What data have the attackers accessed? How can the damage be quickly contained and remediated? A robust incident response plan is absolutely crucial for getting these answers — especially given the strict data privacy regulations coming into effect this year.

Learn more about intelligent threat prevention and incident response

More from Incident Response

How I got started: Incident responder

3 min read - As a cybersecurity incident responder, life can go from chill to chaos in seconds. What is it about being an incident responder that makes people want to step up for this crucial cybersecurity role?With our How I Got Started series, we learn from experts in their field and find out how they got started and what advice they have for anyone looking to get into the field.In this Q&A, we spoke with IBM’s own Dave Bales, co-lead X-Force Incident Command…

How Paris Olympic authorities battled cyberattacks, and won gold

3 min read - The Olympic Games Paris 2024 was by most accounts a highly successful Olympics. Some 10,000 athletes from 204 nations competed in 329 events over 16 days. But before and during the event, authorities battled Olympic-size cybersecurity threats coming from multiple directions.In preparation for expected attacks, authorities took several proactive measures to ensure the security of the event.Cyber vigilance programThe Paris 2024 Olympics implemented advanced threat intelligence, real-time threat monitoring and incident response expertise. This program aimed to prepare Olympic-facing organizations…

How CIRCIA is changing crisis communication

3 min read - Read the previous article in this series, PR vs cybersecurity teams: Handling disagreements in a crisis. When the Colonial Pipeline attack happened a few years ago, widespread panic and long lines at the gas pump were the result — partly due to a lack of reliable information. The attack raised the alarm about serious threats to critical infrastructure and what could happen in the aftermath. In response to this and other high-profile cyberattacks, Congress passed the Cyber Incident Reporting for Critical…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today