Cybersecurity Awareness Month: Go the Distance & Keep Growing
Hello and welcome to the third week of indulging in more cybersecurity practices to help you and your organization stay protected against modern digital threats! Last week, we discussed some crucial steps for organizations to take and this week we’ll be diving into formulating incident response plans to be prepared for system disruptions.
We spend lots of time (and money) implementing practices and deploying tools to build cyber defenses, but consider the following question: what happens when something goes wrong regardless of the defenses you’ve built?
From zero-day vulnerabilities to good, old-fashioned social engineering, there's no way to defend against every conceivable attack vector, but having an incident response plan can limit the impact of one through preparation, equipping for continuing operations, and exercising post-incident reporting.
Preparation
Organizations should develop, maintain, and update an incident response at least once per year. This preparation is critical for when systems go dark and disaster starts to occur.
Think of it like a fire drill: nobody wants to figure out the exit route while the building is filled with smoke! That’s why we practice fire drills. The same should apply to your IT incident response processes. Everyone from leadership to IT teams should be involved in these plans because each group has their role to play.
Imagine a ransomware attack where the technical staff have contained the threat to keep it from spreading, but no one knows who’s responsible for notifying your customers. You have an obligation to warn your customers about potential fallout, but you certainly don’t want your employees to disclose sensitive information about the situation without approval.
In this scenario, the technical response worked, but the organization did not fully treat the attack from start to finish. This highlights the importance of extending incident response plans beyond the IT team and drilling them at least once a year. Not sure where to start? Finish reading this post, then take a look at CISA's incident response plan basics.
Continuing to Operate During an Incident
Containing an incident is only half the battle. Can you keep operating while systems are down? If so, in what capacity? Will you miss deadlines or violate service level agreements?
Your incident response plan should include considerations for business continuity: recovering and restoring services to critical assets. How can you ensure your operations don’t grind to a halt if there’s a major IT outage? Consider which systems have the highest impact and prioritize getting them back online ASAP.
For example, hospitals operate efficiently with digital systems, but they must be prepared to operate if those systems go down. In these situations, the consequences can be far more dire than an insurance firm needing to delay invoices. Attackers know this, so medical facilities have become a tantalizing target for cybersecurity attacks.
When Kettering Health experienced a widespread ransomware attack in 2025, they were able to keep medical centers and emergency departments operating by reverting to manual pen-and-paper recordkeeping until key systems were brought back online.
Regardless of your industry, having a fallback plan can keep your business afloat during major disruptions.
Responsible Reporting
Finally, let’s talk about reporting incidents once they have occurred. This includes internal and external reporting, which improves the prospects for avoiding future incidents.
First, develop an internal report which describes what happened and when. Identify protection mechanisms that functioned as intended and any that didn’t. A postmortem review can establish areas for improvement to prevent the situation from recurring. Following through on identified gap areas creates an environment of continuous improvement that keeps the organization protected.
If you’re a member of the defense industrial base (DIB) handling controlled information, including Controlled Unclassified Information (CUI), you are statutorily required to report any incident involving CUI via the Department of Defense Cyber Crime Center (DC3) within 72 hours of confirming an incident occurred.
Where appropriate and in line with legal and contractual obligations, report relevant information to federal organizations such as the Cybersecurity Infrastructure and Security Agency (CISA). Providing information such as compromise and attack methods to CISA helps them monitor trends, publish relevant advisories, and create tools to reduce the risk of cybersecurity threats occurring in the real world. Your report might help another organization spot the same attack before it hits them!
Key Takeaways
The most important concepts to take away from this post are:
Make sure your organization has an incident response plan and employees can locate it.
Run realistic drills with more than just the IT team involved.
Develop a plan to ensure critical work continues if systems go down.
Know when and how to report incidents according to your obligations and best practice.
You might not be able to prevent every attack, but you can control how ready you are to respond to one! Preparation is what turns a crisis into a tenable situation.
Cybersecurity Awareness Month: One Week Left!
We have one more Cybersecurity Awareness Month post to share where we’ll discuss the 3 Rs of Cybersecurity: (i) Reducing attack surfaces, (ii) Replacing end-of-support devices, and (iii) Recovering quickly to sustain operations. Stay safe and we look forward to discussing the last topic of the month next week!
About Triumvirate Cybersecurity
Triumvirate Cybersecurity is a CyberAB Registered Practitioner Organization (RPO) which specializes in cyber compliance for small and mid-size government contractors. Based in Dayton, Ohio, we help organizations make sense of requirements, implement effective security programs, and achieve compliance with confidence so they can get back to what they do best!
Ready to level up your journey towards compliance? Reach out through our Contact page or directly via email to info@triumviratecyber.org.
