Building a Resilient Cybersecurity Strategy

Prevention is not enough

Even well-run organizations face incidents. A resilient strategy assumes something will go wrong and prepares the business to detect it quickly, limit the damage and recover with the right legal and customer communication.

Four building blocks

• Know your risks: list critical systems and data, and rank threats by business impact.
• Set clear ownership: assign accountable owners for each control and for incident decisions.
• Manage third parties: assess vendors that touch your data or systems, and write security duties into contracts.
• Practise response: run a tabletop exercise that includes legal, communications and leadership.

Bring legal and governance into the plan

Incident response is also a legal process. Decide in advance who assesses notification duties to regulators and affected people, how evidence is preserved and who speaks to customers. Boards should receive short, regular reporting on cyber risk in business terms.

Measure and improve

Track a few simple measures, such as time to detect, time to recover, and the share of critical vendors assessed. Review them after each incident or exercise and update the plan.