The 5 'Ts' of cyber-crisis readiness for every kind of organization

• Cyber-resilience is a fundamental principle in the face of rising threats to digital security.

• Cyber-crisis preparedness is a crucial part of broader cyber-resilience, no matter how big or small your organization.

• Talent is the most important of the five "Ts" of cyber-crisis preparedness.

In a world of continuous change, challenge and chaos, it is critically important that every organization – from the smallest mom-and-pop business to medium-size nongovernmental organizations (NGO), government agencies and global multinationals – has concrete cyber-crisis readiness plans ready for deployment at any time. Not having this aspect of cyber-resilience in place before the “big” cyber event occurs can become a serious, material or even deadly financial and reputational hit to any entity and its leaders. That has become especially true in this era of multiple cyber and pandemic crises.

As seen in a recent World Economic Forum piece, there are eight essential elements of building a cyber-resilient organization, as illustrated and summarized in the diagram below:

In this article, we delve more deeply into the nuts and bolts of one of these elements – crisis readiness – as it applies to cyber-risk and security management. We offer five critical aspects of building effective cyber-crisis readiness, the overarching purpose of which is to build, retain and continuously improve organizational cyber-resilience.

Before we outline the five “Ts” of crisis readiness, let’s get our arms around the meaning of “organizational cyber-resilience”. Here is a definition from a 2020 Swiss Re/GEC Risk Advisory White Paper on this topic:

So, in addition to resources, governance and cross-integration with other programmes within an entity (like risk, business continuity and education), effective cyber-crisis preparedness is an essential part of building and maintaining cyber-resilience.

While the details and tactics of building organizational cyber-crisis readiness will depend on a lot of factors (size, geography, industry, maturity level, diversification, human capital, purpose, complexity, products, services, etc.), there are clear categories of actions that any entity should take that are customized to that entity and its purpose and portfolio. These are the five “T’s” of cyber-crisis readiness:

The most essential component of cyber resilience (and cyber-crisis readiness specifically) is to have the right people preparing by sitting around the virtual or actual table, rehearsing for actual cyber crises and dealing with them when they come.

A well-formed crisis management team and plan will consist of:

It is critical for an organization to have determined its overall technology and information security (infosec) governance approach – in other words there needs to be a method to the madness of how an organization determines, protects and runs interference on all things digital within its footprint.

This would include connecting the dots and having an overall philosophy determined at the highest levels of the organization (including the board and management) on how to deal with overarching data, infosec and cybersecurity governance, as well as linking crisis management to the following:

An entity – regardless of size – must have some form of cyber-hygiene education plan in place where testing of the system and teaching of staff and third parties about the “do’s and don’ts” is critical and always ongoing.

Training and preparedness need to extend to all corners of the organization from the very top (the board should be informed and trained regularly on the entity’s cyber-resilience) to the latest recruits, and across all disciplines, functions, operations, sub-entities and far-reaching locations. Moreover, crisis-preventing cyber-hygiene training and communications should extend to the supply chain ecosystem of an entity as well, since so much of the cyber-threat matrix enters an entity’s domain through third parties.

As the people, governance, training and communications pieces of a cyber-crisis plan take shape, it is critically important that the team and the plan have the right insight into and mapping of all the necessary and desirable technology tools deployed throughout the organization – both in advance of a major cyber-crisis and for purposes of maintaining post-crisis business continuity.

When looking at security tools that should be in place, there are three key concepts to consider: visibility, simplicity and automation.

Finally, there is a series of important system-wide practices and policies that need to be part of the cyber-crisis readiness approach of every entity that helps to triangulate (identify, mitigate and solve) problems preferably before they happen but often after the fact as well. They include:

We believe that businesses, NGOs, government agencies and other types of organizations will truly benefit from this systematic approach to building a deliberate cyber-crisis-ready approach. In this way, the worst of the downsides of a cyber attack can be mitigated and maybe even thwarted because of the coordinated and seamless approach of the internal team and their external experts, infosec governance, and the technology tools deployed to build sustainable cyber-resilience.