by Lisa Ventura MBE FCIIS
After a weekend at the emergency vets with my beloved dog Poppy, she is now doing much better, eating properly and taking her medicine wrapped in ham. On Saturday, when Poppy was admitted to the emergency vets for an overnight stay, it turned out they didn’t stock her special food. They had an alternative brand, but there was no way I was giving her a different food to what she usually has when she was so unwell.
My husband and I therefore had a 2-hour round trip to drive back home across Worcester in heavy Saturday traffic as the Pets at Home store near the emergency vets didn’t have any of her special food. And last Friday night the emergency vet on duty suggested that Poppy didn’t need the treatment she eventually got when it wasn’t our first rodeo with her condition, and we knew she would end up having to have it.
So now that the dust has settled a bit after the events of the weekend, I’ve packed her a “hospital bag” should she need to go to the emergency vets at very short notice again. It made me think about how few organisations have the same thing ready for a cyber incident. Her hospital bag now sits in the understairs cupboard by our coats, ready to grab.
Here’s what’s in it, and the cyber lesson behind each item:
🥫 A few tins of her special food
Don’t assume someone else will have what you need. Know which systems and suppliers you rely on and have a fallback for each one.
💊 A strip of her enzymes and B12 meds
Poppy’s essentials need to travel with her, especially her medicines. Keep offline backups of your critical data and test you can restore from them.
📄 A document listing her conditions, medication regime and treatment needs
No vet has to guess at 10.30pm at night what Poppy needs, as it is all documented for them. Your incident response plan should do the same job and list who to call, what matters most and what to do first. Print a copy and keep it safe because if your systems are down, so is any plan stored on them.
🧸 Her blanket, toys and one of my worn tops
Comfort matters in a crisis. Your people will be stressed and tired, so plan for shifts, breaks and regular updates so that nobody burns out by day 2.
📍 Kept by our coats
My husband and I know where the bag is stored so we can grab it quickly if Poppy needs it. Make sure your team knows where your plan lives and how to reach it out of hours.
A few more things to do to test your cyber-attack response plan before you need it:
- Run a tabletop exercise with your team at least once a year
- Keep an out of hours contact list for key staff, suppliers, your insurer and your incident response provider
- Agree who makes decisions, and who speaks to customers and the press
- Review your plan after every incident, big or small
Neither myself or my husband was prepared for Poppy to get so poorly so quickly and have to be rushed to the emergency vets late on a Friday night. Nobody plans for a cyber-attack on a bank holiday weekend either. Cyber incidents rarely arrive at a convenient time, and they don’t wait while you look for the right phone number or the latest version of the plan.
Poppy’s bag took me 20 minutes to pack with all the essential items that she needs along with a printed copy of her conditions and what medication she needs. Your incident response plan will take longer, but the principle is the same. Do the thinking while things are calm, so you only have to act when things go wrong.
If your organisation had a cyber incident tonight, could you find your plan, reach the right people and keep going without your systems? If any of those answers is no, that’s your job for this week.
If reading this has made you realise your organisation’s incident “hospital bag” isn’t packed yet, I can help. Through Unity Group Solutions Limited, I work with organisations to write, review and test cyber incident response plans. That includes plans your team will be able to find and follow at 10.30pm on a Friday night. Email me at lisa@unitysolutions.org.uk and we’ll start with what you already have.
