Develop Cyber Training and Contingency Plans
Preparation is key for protecting an organization from cyberattacks. This primarily entails ensuring monitoring and security measures are in place to prevent breaches and detect when they occur. While this preparation is a responsibility for IT, HR teams can partner with them to help contribute to cybersecurity in their own way: employee training and contingency planning.
Every employee in an organization should be trained on proper cybersecurity protocols and best practices. This includes knowing how to spot a phishing scam, maintaining strong passwords, using unique passwords for different logins and reporting suspicious database activity. While HR teams likely aren’t comprised of IT experts, they can still help disseminate these and other cybersecurity best practices to employees. Even basic precautions can make a huge difference in protecting against breaches of critical data.
However, not every breach is preventable, nor are all breaches the same. It’s one thing for a cybercriminal to get a list of first names; it’s another thing for them to steal both names and Social Security numbers. Moreover, employers can still have their data compromised even if they take all the right steps. After all, a breach may occur at a third-party vendor, a situation over which employers have no control. This means it’s also vital for HR teams to strategize about cyberattack contingency plans.
Essentially, these plans can help employers make sense of a data breach once it occurs and kick off the recovery process. Generally, a cyberattack contingency (or response) plan should cover the following aspects:
- What data has been impacted?
- How sensitive was the data (i.e., does the breached data include addresses, Social Security numbers or banking information)?
- What is the employer’s obligation to report the data breach (i.e., sometimes customers, employees, the government or all the above need to be notified)?
- Based on the type of data breach, how quickly must the incident be reported to applicable parties?
Depending on an employer’s state and industry, the answers to these questions will vary. That’s why it’s essential to address these issues in a cyberattack contingency plan before a breach occurs. Employers should speak with legal counsel for help understanding their coverage risks.
More specifically, a data breach that affects an organization almost certainly will affect its employees, even if the compromised data seems unrelated to staff. That’s because employee credentials are often stolen to access larger databases. While employee credentials may not be the intended target of a breach, they can still get swept up during the cyberattack along with other pieces of personal data.
In other words, regardless of the type of data breach or its scope, employees may have concerns about their own information when one occurs. Therefore, HR teams should be ready to field employee questions related to a breach and have meaningful response measures in place. For instance, if employee data is compromised (potentially or actually), employers may provide free identity theft protection or credit activity monitoring services to their staff.
Cyberattacks aren’t going away any time soon. In fact, they’re likely to increase. According to the Identity Theft Resource Center, ransomware-related cyberattacks have doubled during each of the last two-year periods. This means now is the time for employers and HR teams to prepare for eventual cyberattacks by training employees and solidifying contingency plans.