Pre-breach preparation for fast, effective data breach recovery

In our experience, most businesses follow a similar sequence of steps to develop tailored plans that are proportionate and relevant to their operations and the risks they face.

Consumer-response scenario to assess readiness

As a first step, most businesses like to run through a desktop scenario to identify gaps in their processes and resources. One of our specialists will walk through the processes involved in responding to a data breach and managing a mass consumer notification programme. We find these sessions are most effective when delivered in person, involving representatives from all teams that would have a role to play in the consumer response – including PR, legal, IT, business-continuity, supplier-management, customer service and marketing teams.

It’s often only when we talk through the practical steps involved that individuals realise how many decisions need to be made very quickly following a data breach. How will customers be notified? Where will the data come from? Who is responsible for cleansing it? What notification templates will be used?

Following the scenario, we provide a report recommending the actions required to better prepare the business. This helps businesses gauge their readiness and decide whether they need further consultancy support to get the necessary plans and resources in place.

Consultancy advice to develop tailored playbook

Our consultants can work closely with businesses to create a crisis-response playbook, including actions, responsibilities, resources and processes. We explore the customer notification strategy and how it will be delivered in practice. We scope out contact-centre resources, including who will provide them and what information they need. What is the tipping point beyond which the business cannot handle the consumer response internally and needs to call on external resources? We develop templates and consumer FAQs in advance, and iron out the details of the response strategy. We then run the strategy through a model to calculate the resources required to deal with different scales of data breach.

Essentially, we help businesses make as many decisions as possible up front, so that if a data breach occurs they won’t have to make knee-jerk decisions under duress. By thinking everything through rationally in advance, businesses can make sensible decisions about who does what and when to deliver an efficient, damage-limiting, customer-focused response.

Virtual simulations to stress-test plans

The third element in pre-breach preparedness is to stress-test the response plans. With their playbook in place, business leaders are well-advised to put it to the test in a real-life scenario. We run regular virtual simulations with businesses to replicate different types of data breach – to see how well their plans can be delivered in practice. Finding out how those well-laid plans hold up under pressure is critical to ensuring the business is properly prepared. We find that putting people into their post-breach roles and asking them to respond in real-time is the most effective way to discover how ready the business really is – and where their playbook needs to be refined to plug any gaps.

Simulations also help companies understand that the type of data compromised in an attack influences the severity of the consequences for customers. Taking certain types of data offline could prevent consumers making essential payments or accessing critical services. It highlights the need to draw up a risk register, identifying the different types of data held and the real-world impacts of that data becoming unavailable.

For larger organisations, we may identify different operational or geographical areas of the business that have different risk profiles, priorities, assets and data. These may need more tailored crisis-response plans to address specific risks. This complexity, combined with widespread digital transformation and the rise of AI, means that companies must constantly reassess their response plans in line with changing assets, risks and threats.

Planning and resources key to post-breach recovery

To have the best chance of recovering well from a data breach, businesses need to have well-thought-through response plans in place, combined with adequate resources in-house or on standby to manage all aspects of the response. Now is the time for organisations to bring in the necessary expertise to establish such plans, and to lock down the resources they will need for an effective post-breach recovery.