Don't Meet Law Enforcement for the First Time During an Incident

The companies that handle a cyberattack best usually did the groundwork long before the attack.

The groundwork

• A written incident response plan, with names and phone numbers, not job titles.

• A practice run, even a short tabletop exercise, at least once a year.

• A known contact at your local FBI field office or other law enforcement, made before you need them.

• Clear rules for who talks to customers, regulators, and the press.

• Outside counsel and incident response support lined up in advance.

Why it matters

In the first hours of an incident, every decision is time-sensitive. Who has authority to shut systems down? Who calls the insurer? Who calls law enforcement? If you are working out those answers live, you are already behind.

When it's 2 a.m. and systems are down, you want to be following a plan, not writing one.

Views are my own. Dave Trader is a CISO, U.S. Marine Corps veteran, and author of The Cybersecurity Endgame.