Building incident response preparedness: How to test, train and validate your plan

When a cyber incident strikes, it’s not just an IT problem — it’s a business-wide crisis. From operational downtime to data loss, legal exposure, and reputational damage, every hour counts. In this video, our cybersecurity consultant, David Chadwick, explains why incident response preparedness, such as planning and exercises are critical for organisations of every size. 

The video covers cyber incident response preparedness:

• Why fast response limit attacker dwell time and data loss
• The financial, legal and regulatory impacts of a breach
• The difference between tabletop and live-play exercises
• How to validate your incident response plans and identify gaps
• How to recover operations and implement lessons learned

David: 

Why incident response is a business-wide issue

When it comes to incident response, it’s not just an IT-related problem; it’s a whole business problem. Sitting on it, waiting, just allows the attackers more time to dwell in your environment.

It allows them to move across different systems, so we respond as quickly as possible. It’s not just your IT team responding to an incident, but you also need communications internally and externally.

From planning to preparedness: why testing matters

You need to look at the financial aspects of a cyber incident. How much is this going to cost you in lost revenue? But also in the cost of rebuilding your environments.

You also need to look at the legal and compliance aspects, particularly if there’s been a personal data breach.

You need to inform those data subjects of the breach, but you also may need to inform regulators, including the ICO and any other industry-specific regulators, too.

Having a cyber incident response plan is essential for organisations because it helps them be prepared for an incident.

Incident response frameworks

There are a couple of common frameworks out there, industry standards. They will give you the best practices for responding to an incident.

Those are ISO 27035 and also NIST 861. They offer a lifecycle [00:01:00] model, preventing that incident from happening and securing new systems.

At Evalian, we’re very customer-focused, very client-focused. Everything is tailored. We take the time to understand what your organisation does, how you work, what keeps you up at night, as well as what the big risks to the business are.

Then we’ll use that to understand what the client needs. I’ll hold discovery calls with the clients. What I’ll get from that is I will understand what sort of systems and technologies they’re using, looking at what sort of services they provide, and who the customers are. Then we look at who might attack them based on what sector they’re in.

So if they are in a critical national infrastructure, it could be an advanced persistent threat that just wants to sit on their network, gather data, exfiltrate that data, and provide it to the government that they’re working for. If it’s an organised crime group, it’s likely going to be financially related.

It’s understanding what you do in the event that data has been stolen, your systems have been locked down, and you can’t operate. So it’s looking at that recovery and how you get back up and running. But also asking that question, would you pay the ransom in this instance?

Tabletop vs live-play exercises: what’s the difference

Tabletop exercises are a round, the table discussion-based. We’ll run through policies, procedures, and plans, and we’ll validate those plans as well, also identifying gaps in areas for improvement. Whereas a live-play exercise is much more immersive.

How to validate your incident response plan

We’ll use tools and technologies, potentially setting up demo environments, which is segregated from the network, validating the security tooling is working and then validating those instant response procedures by getting those people who are your incident handlers to actually respond to what is a simulated incident. We’ll then move on to how the systems are eradicated, to how you get rid of the threat from your systems and how long it’s going to take you to recover as well.

Post-incident learning: closing the loop

Following that, we go through the post-incident, so what are that organisation’s post-incident procedures? Where are they going to record the lessons learned? How are they going to implement them? How are they going to make sure that they get implemented as well?

How Evalian helps strengthen your incident response capability

If you need help or advice on maturing your Incident Response process, we can help. We’ll help you to create a suite of incident response documents, including the plan, policy and playbooks tailored to your organisation, as well as assess your current procedures against industry best practice and deliver incident response tabletop training exercises and provide expert recommendations for improvement to prepare your business for potential security incidents.

Download your free Guide to Cyber Incident Response. 

At Evalian, our cyber incident response services are tailored to your environment (read our incident response case study for St John’s College), sector, and risk profile. Whether you’re refining your existing response plan or starting from scratch, we’ll help you prepare, respond, and recover effectively.

View our cyber incident response service

Contact us using the form below for further information on how we are able to assist in your Incident Response and security training needs.