Why pre-breach planning is critical to a successful response and recovery

Given the increasing likelihood of a data breach, organisations need to be prepared to manage the fall-out – while minimising damage to their customers, finances and reputation. That requires careful planning in the calm of a pre-breach environment, to ensure that adequate plans and resources are in place to handle a crisis response under pressure.

Experian offers three tiers of data-breach readiness consultancy to help companies explore the realities of a data breach, and implement plans for an efficient and appropriate response.

1. Response Aware – free readiness service

This free service enables companies to establish a relationship with our specialist team, sign-off terms and conditions for post-breach services, and agree fixed rates for those services, which include consumer notifications, call-centre resourcing and identity monitoring.

It means that, in the event of a data breach, we can simply provide a tailored statement of work – with no need for further contractual approvals that could delay the response – and quickly swing into action. This service essentially fast tracks a company’s ability to stand-up our resources following a breach.

We find this level of service appeals to two types of business. The first is very large organisations that want to avoid any protracted procurement processes following a breach, which could critically delay an effective response. The second is small companies that can’t afford any initial financial outlay, but want to have our resources on-hand when needed in a crisis.

2. Response Ready – detailed response planning

Here we apply our consultancy skills to help clients prepare for a breach response. We work together to develop a structured response plan, setting out the post-breach processes from start to finish. We look at who needs to be involved in the response, and when – including internal and external resources.

We delve into customer-notification processes. How good is the customer data available? Where is it held and can it be accessed quickly in an emergency? What channels will be used to notify customers – email or letter, a website notice or press announcement? There are pros and cons to each, so we need to ensure the right channels are deployed for different scenarios.

We set up messaging and templates for notifying different groups, including employees, customers, ex-employees, pension-holders and many more. We look at call-centre resourcing and response handling, assessing which internal teams have the capacity to step up, and where external resources will be needed. By thinking about all this in advance, we ensure the right decisions are made and plans agreed long before any data breach occurs.

3. Response Protect – in-depth breach-recovery preparation

Our third tier of consultancy includes desktop scenarios, simulation exercises and resource modelling. In desktop scenarios, we walk the client through a data-breach response, from the moment they first learn about the breach, through insurance and legal notifications, and on to consumer-facing actions. By walking through the entire lifecycle of a post-breach scenario, we identify where plans need to be refined and where there are resource or data gaps.

To put response plans to the test, we run regular simulations. In these virtual exercises, we run through a full post-breach response; we send out notifications and stand up a small contact centre to handle queries. It’s more impactful than a desktop walk-through because individuals have to physically enact the processes in real time, as they would in a real crisis. Simulations enable us to work through different types of breach, such as ransomware attacks, insider threats, supplier breaches or Denial-of-Service attacks – to see how the business responds and where improvements are needed.

The expertise we have built up also enables us to forecast the resources clients will need to respond to data breaches of different magnitudes. Our experience means we understand the likely volumes of incoming calls following a breach, so we can ensure clients have an appropriate level of resource available – without over-spending on excess resources they won’t need.

Who benefits from pre-breach consultancy?

The businesses that face the greatest challenges in responding to a data breach are usually small to mid-sized firms with a large customer base. With limited internal resources, it’s difficult for these companies to maintain business-as-usual activities while taking on the extra work of notifying customers, responding to queries and managing the recovery.

These companies, which are unlikely to have specialist crisis-response expertise in-house, frequently gain the most value from data breach consultancy – and from having retained resources in place to deliver a successful response.