You’re constantly flooded with tips about how to avoid data breaches, and with good reason – they’re more common for businesses today than ever before.
But for some reason we never hear about what to do after a breach occurs. Realistically, your business needs to be prepared. Sitting around and hoping for the best just won’t cut it, even when you’ve got the best security in place for protection. So what should you be prepared for in case your system is hit? In a recent presentation for the IAPP (International Association of Privacy Professionals), Experian Data Breach Solutions pointed out common mistakes made after a breach.
- Not Asking for Help
Don’t put all of the pressure on yourself. Often breaches are too big to be dealt with solely by your own team, especially if your IT is managed in-house, so it’s a good idea to seek external help. At the very least your company should consult with an Incident Response team to craft a business continuity plan if you don’t already have one in place.
- No Outside Counsel
It’s highly recommended that you quickly seek an outside attorney. There’s no single federal law that governs the security of all types of sensitive personal data, so determining which law, regulation or guideline is applicable depends on the data that’s been stolen. Unless your internal resources are knowledgeable about current laws and regulations, your business should invest in counsel with expertise in data breaches.
- Neglecting To Choose a Leader
Simply put, every team needs a leader. A breach affects several parties, but you need one strong voice responsible for driving a response plan and contacting external parties. The team member selected should also be in charge of ensuring that anyone from executives to employees is kept up to date.
- Lack of Communication
Miscommunication can be a huge problem when you’re dealing with a data breach – it’ll delay progress and add more confusion to what needs to be a clear and efficient process.
- No Communications Plan
Another issue businesses are up against is the lack of planning when it comes to public relations. Your business needs to get control of what the media is saying, because the longer news spreads without your input, the more potential clients hear negatives about your security. You should have statements drafted and ready to go in response to your breach.
- Waiting For All The Information
With multiple parties working to neutralize the problems caused by a breach, you’re often working with incomplete or constantly changing information. As soon as an intrusion is confirmed, your business needs to start managing the issue. Waiting for a full picture or perfect information will only delay fixing the problem.
- Micromanaging
Trust your outside counsel and the team you’ve chosen to resolve the issue. Teamwork is essential, but micromanaging will only cause more problems.
- No Remediation Plans in Place
Do you have plans in place for how you’ll speak to clients or customers if a breach occurs? A major road-block after a breach is rebuilding trust and reputation with the public and your existing clients. You also need strategies in place for how to avoid future incidents.
- No Assistance for Consumers
It’s easy to think of all the internal issues that need to be covered, but again – you can’t forget about you clients. Losing your customer base is perhaps the biggest and most crippling effect of a breach – you should set up a call center where they can voice their concerns, a web page with helpful information, and offer credit monitoring if health, financial, or other personal information was compromised.
- Failure to Practice
You NEED to be prepared for a data breach! It’s unfortunate, but it’s our reality. An incident response plan needs to be put in place and updated continually. Getting behind an issue before it occurs is the best way to properly deal with it once it hits.
To get more information about how your business can deal with a data breach and learn how QualityIP can help, contact us at info@qualityip.com or by phone at (330) 931-4141.