Hopefully you won’t have to answer this question, but more than likely you will. The headlines are full of stolen documents or hacked databases, but most of the data breaches never see the light of day. Why not? Because no one wants to talk about their failures and vulnerabilities. If I tell you that your confidential information is now making its way around the Internet, you will lose confidence in me. You might go to my competitor or tell your friends to avoid my company. None of these sound good.
So what do you do?
Here are 3 things you should do when you discover a data breach:
1. Respond
The first thing is to tell people about the breach. Most states in the US require breach notification so you need to get this information out fast; most countries have or at looking to implement similar laws. Tell people what the threat is and what the damage might be. Notify your customers, the media, law enforcement, your employees, your investors and state or federal officials, depending on your industry. This is not the time to be timid. Help your customers deal with the exposure and provide remediation services, such as credit protection, if that’s appropriate. Failure to do so causes more harm than sticking your head in the sand. It’s better to be proactive and inform everyone, rather than having people find out on the evening news.
2. Assess
Figure out what happened and what to do about it. This may seem like the first step, but as any firefighter will tell you, first you contain the fire, then figure out how it started. You most likely will discover some combination of people, process or technology breakdown. It’s rarely just one. Determine the causes and how to prevent them from happening again.
3. Fix
Create a plan, if you don’t already have one, and execute. This should include training people on information security, implementing processes to prevent the leaking of sensitive data and technologies to plug vulnerabilities.
Experiencing a data breach can be devastating to any business, but informing those affected quickly is your first step. You should expect problems to occur, but how you handle the problem and quickly remedy the situation says a lot about your commitment to your customers, employees and investors. It’s better to over communicate than bury your head in the sand and hope it all goes away.
– Written by Ron Arden
