Compliance Need to Know: “It Doesn’t Happen….Until It Happens,” Cyber Security, Part IV
This is the final installment of our cybersecurity series. To catch up on our story, click here.
The traffic back to the office was, of course, bad. Tom thought, “It's 11 o’clock! Why?”
Sitting in a traffic jam on I-35, Tom thought he might as well make his time useful. He had cyber consultants, and the phone number was in his phone. This was a breach, and he did not know how it happened. Each gap between rings took forever. A familiar voice picked up the phone, “Hi, this is Kyle. Thank you for calling Computer Defenders.”
“Hi Kyle, this is Tom Harling from financial – “
“Tom, how are you doing? What’s wrong? We don’t have a meeting scheduled?”
“Kyle, my firm has been hacked. I don’t know what… what has happened? I have compromised accounts; I have clients that have accounts that I don’t have any access to compromised!”
“Tom, we will do an investigation. But for right now, have you pulled your network offline and notified all of your employees?”
“Yes, we are going through our BCP as we speak. We have shut down the website, and the API’s through to the broker/dealer have been cut. Currently, my staff is reaching out to the branch offices to notify them.”
“Great! We will have a team onsite to run forensic testing of your system as soon as possible.”
“Wonderful, Kyle.”
“Tom, it will be ok. I will give you a call back in a little bit to set up the time.”
Tom got back to the office. “Rebecca, can you come up with a template explaining what happened so we can call our clients?”
Susan and Danny walked up. “Susan, have you started to call your clients to notify them what happened?”
“Yes, and all of the branches are doing the same thing,” Susan replied.
“Good. Maintain a call log. I want a hundred percent coverage on this. Danny, can you call our CRM company and explain what has happened and what steps they need us to take to secure our data?
I need to call the SEC, the insurance company, our attorney, and the police.” Tom said. “I also need to call the compliance consultants to see what state laws we need to follow. I think we might need to file notice of this to the attorney general’s office. Rebecca can you give me a client count per state when you get a chance.”
“Well, good news.” Danny chimed in, “The B/D said that most of the damage has been mitigated and shouldn’t cost us very much.”
“Danny, we don’t sell steel, or cars, or popcorn. We sell trust. This breach has cost us everything.”
There, are several different steps that a business needs to take immediately following a cybersecurity breach. Notify your employees and give them guidance on further actions. Inform your customers. Call your regulators. Talk to computer consultants and run forensic testing to ensure there are no other threats. The incident response plan or BCP should be tested at least annually and updated as needed. The BCP should be a living document because it is your best protection for an incident that can kill your business.
For more information about our services, contact us by calling us at 1-833-RIACCIO, emailing us at info@riacc.io, or by clicking here to schedule a free consultation.
