Assuming your IT provider has it covered.

Your IT company keeps your systems up and running and ensures you have the technology to achieve your goals. Your cyber resilience should be part of this, but don’t assume what importance is being attached to it. Dedicated time focused on mitigating your cyber risks should be a regular part of your review process.

You’ve backed up your data. But can you recover it?

It might seem like a hassle, but you can’t have complete confidence in your back-ups if you haven’t tested recovery. This should be a regular part of your cyber resilience plan.

Questions to ask include: Are backups isolated from the main network? Could ransomware compromise the backups? How long would recovery take? Can the business operate while systems are down? How would business interruption insurance respond to such an event?

Your people are your greatest risk.

Despite the growing sophistication and advanced tech deployed by the cyber criminals, the most common cyber breaches are still exploiting human frailties. Regular staff training and generally raising the awareness of cyber threats needs to be a continuous process.

Forgotten technology.

Out of sight, out of mind. Unsupported software, forgotten accounts and unused devices may be presenting a cyber risk hiding in your old systems. Good housekeeping is clearly the best defence.

A rogue employee.

Not one we like to think about and probably more likely in very large businesses. It does nevertheless happen that an angry employee can turn into a maligned actor seeking to do damage to his employer. Perhaps more common is the member of staff moving to a competitor and taking competitively sensitive data with them. This is a hard one to protect against but applying the principle of least privilege access helps minimise the damage that a rogue employee can inflict. Obviously, immediate withdrawal of access on departure should be standard.

Supply chain vulnerabilities.

Be aware of the vulnerabilities that could be introduced to you if companies in your supply chain do not have good cyber resilience practices.

Passwords aren’t enough.

We wouldn’t be happy if our banks allowed us access to our accounts with just a password and we should think of our sensitive data in the same light. Multi factor authentication should be standard for all systems with sensitive data.

Cyber incident response.

If your business was hacked tomorrow, what would be your immediate response? Time is of the essence in a cyber incident, and having a clear plan articulated for the business helps reduce stress (in a very stressful situation) and achieve a better outcome. Indeed, one of the best aspects of quality cyber insurance is access to specialist cyber response teams. They spend each and every day doing this and give you the best chance of emerging quickly from an incident with minimum disruption and reputational damage.

Social engineering and funds transfer fraud is still common.

Having robust systems and regular awareness training in your accounts payable departments, especially around changes of bank account details, is essential.

We hope the above provides useful food for thought? Regular conversations with your IT providers, adopting best practice and creating a culture of cyber threat awareness is your best protection. The cyber criminals are constantly evolving however, and you can never completely eradicate the risk of a cyber incident. This is where a quality Cyber Insurance product can fill the gap. Our customers are often surprised by the value of cyber insurance. If you would like to explore what it might cost and how it could help protect you then please get in touch. As a specialist cyber broker, we have access to a fantastic panel of insurers and the expertise to guide you to the most suitable product for your needs.

If you’d like a chat please call us on 0333 091 2730 where one of our super friendly and knowledgeable team will be delighted to help or use our contact form.