(Editor’s note: This is the first of a two-part series on business-related cybersecurity issues. See part two here.) YOU’RE SURROUNDED BY FAMILY and friends on your birthday, and you’re about to blow out the candles on your cake. Just as you take a deep breath, your cellphone lights up with a text from your information
Already a Subscriber? Log in
To Continue Reading This Article
Become a Providence Business News subscriber and get immediate access to all of our premier content and much more.Learn More and Become a Subscriber
Kevin Ricci[/caption]
In terms of internal communications, start by contacting an attorney, preferably one with which you have an established relationship and who is familiar with cybersecurity and breach response. Involve them in the response process so that no compliance steps are overlooked. The next call should be to a resource with expertise in breach response and who can quickly strategize and mobilize to stop the damage, determine what has been compromised, and begin the recovery. While this call may be to your existing IT department or consultant, a cybersecurity specialist possesses a different set of skills than an IT specialist. Although both resources are critically important after a breach, they are more often than not treated as the same. And since the costs related to responding to a data breach can quickly add up, take a moment to contact your insurance company to put them on notice of the potential loss and confirm if you have coverage.
Of vital importance is external communications. Your communications team should be ready to work with your legal counsel to contact law enforcement and address any compliance requirements. For example, if you maintain protected health information, there are specific reporting communications that need to be made to comply with Health Insurance Portability and Accountability Act privacy regulations. Virtually all types of sensitive data have compliance requirements. Be sure that your company is familiar with the related communication protocols. Also, assign a qualified individual to quarterback any communications with the media. When your data is hacked, efficient communications are critically important. Familiarize yourself with the many communications that will be required and rehearse them so your business will have the best chance of quickly and completely recovering from a data breach.
Being prepared is the only way to properly deal with a data breach. Having a plan in place that addresses the communications requirements is critical because failure to communicate is not an option when your company has been hacked.
Brian J. Lamoureux is a partner at Pannone Lopes Devereaux & O’Gara LLC. Kevin Ricci is a director in cybersecurity at Citrin Cooperman.