登录查看更多内容

How can you coordinate incident response with vendors, partners, and customers?

由人工智能和领英社区提供技术支持

When a cyberattack or a security breach occurs, you need to act quickly and effectively to contain the damage and restore normal operations. However, you are not alone in this process. You also need to coordinate your incident response with your vendors, partners, and customers, who may be affected by the incident or can help you resolve it. In this article, you will learn how to communicate and collaborate with your external stakeholders during an incident response, and what best practices to follow.

在这篇协作文章中查找专家回答

由社区从 6 条内容中精选。了解更多

1 Define roles and responsibilities

Before an incident happens, you should have a clear understanding of who is responsible for what in your incident response team, and how they will communicate with each other and with external parties. You should also identify your key vendors, partners, and customers, and establish contact points, escalation procedures, and service level agreements with them. You should document these roles and responsibilities in your incident response plan, and review and update them regularly.

添加您的观点

SANJAY KUMAR RAI

Driving Digital Transformation and Growth in Africa | Author | Motivational Speaker |Best CEO Award Winner I Most Inspiring Business Leader Award Winner I PMP | CISA |
举报内容
Here are steps to facilitate seamless collaboration: Establish an Incident Response Plan: Develop a comprehensive incident response plan that outlines roles, responsibilities, and communication protocols for internal teams as well as external entities. Identify Key Contacts: Maintain an up-to-date list of key contacts within your organization, vendors, partners, and customers. Include their roles, responsibilities. Communication Protocols: Define clear communication channels and protocols for incident reporting and updates. Establish primary and alternate communication methods, such as email, phone, and collaboration platforms. Incident Notification Process: Clearly define how and when to notify external parties about an incident.

已翻译

赞
Deepak Joshi

CISO, Cybersecurity, Data Privacy, GRC, AI / ML, MTech IIT Delhi, CISSP, CIPP/E, CHFI, ISO 27001 LA, 27701 LA, 42001 LA, PhD Research Scholar Deepfake Image Forensics
举报内容
One very important thing what i have seen that people go wrong in defining roles and responsibilities is that the roles have to be defined for an appointment and not associated with a name. Why i am saying so is because people change and then the other person may not be aware or may that he is not XYZ. Further, going a step further when recruiting any individual for an appointment pls tell them also their role in incident response and same can be briefly included in job description and then in detail in onboarding.

已翻译

赞

加载更多内容

2 Notify and inform stakeholders

As soon as you detect an incident, you should notify your vendors, partners, and customers who may be impacted by it, or who can provide assistance or resources. You should use the predefined communication channels and methods, and follow the agreed-upon protocols and formats. You should provide relevant and accurate information about the incident, such as the nature, scope, impact, and status of the incident, the actions you are taking, and the expected resolution time. You should also set clear expectations and boundaries for their involvement and cooperation.

添加您的观点

Deepak Joshi

CISO, Cybersecurity, Data Privacy, GRC, AI / ML, MTech IIT Delhi, CISSP, CIPP/E, CHFI, ISO 27001 LA, 27701 LA, 42001 LA, PhD Research Scholar Deepfake Image Forensics
举报内容
When informing about the incident be very clear who is to be the one informing specially when informing media or high business clients. Also keep in mind that there is a level to which everyone is interested to know and hence you should be informing accordingly. Dont be in a hurry to inform every minute detail to everyone. Lastly what i want to add is that have a call tree and keep the details of contacts of key persons in hard copy as well because many times the incident may not leave your systems in a condition to be accessed seamlessly.

已翻译

赞

3 Collaborate and coordinate actions

During the incident response, you should work closely with your vendors, partners, and customers to share information, resources, and expertise, and to coordinate your actions and decisions. You should leverage their skills, tools, and capabilities to help you investigate, contain, eradicate, and recover from the incident. You should also align your goals, priorities, and strategies with them, and avoid conflicts or duplication of efforts. You should maintain regular and transparent communication with them, and update them on any changes or developments.

添加您的观点

Stephen Phebus

Field Services Technician @ Stage 4 Solutions | Hardware Support
举报内容
One thing I've found useful in coordinating efforts is to establish a bridge call or Teams Meeting to allow everyone to collaborate in real time while on the call.

已翻译

赞

4 Document and report outcomes

After the incident is resolved, you should document and report the outcomes and lessons learned from the incident response to your vendors, partners, and customers. You should provide a detailed and honest account of what happened, what you did, what worked, what didn't work, and what you learned. You should also acknowledge their contributions and feedback, and thank them for their support and collaboration. You should use this opportunity to evaluate and improve your incident response plan, processes, and relationships with them.

添加您的观点

5 Follow up and maintain trust

Finally, you should follow up with your vendors, partners, and customers after the incident response, and maintain your trust and reputation with them. You should monitor and address any residual issues or impacts from the incident, and provide them with any necessary assistance or compensation. You should also solicit and implement their suggestions and recommendations for future improvement and prevention. You should demonstrate your commitment and accountability to them, and show them that you value their partnership and customer loyalty.

添加您的观点

6 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?

添加您的观点

Deepak Joshi

CISO, Cybersecurity, Data Privacy, GRC, AI / ML, MTech IIT Delhi, CISSP, CIPP/E, CHFI, ISO 27001 LA, 27701 LA, 42001 LA, PhD Research Scholar Deepfake Image Forensics
举报内容
With my experience what i want to add here is that the level at which the decision to ascertain severity of an incident and response to it can be decided. There has to be standard operating procedures to enable people at operational and tactical levels to decide and act swiftly rather than calling seniors endlessly, while seeing situation worsen and then act when the situation is complex.

已翻译

赞

Information Technology

+ 关注

给文章评分

我们借助人工智能创建了此文章。您认为这篇文章怎么样？

很棒不太好

举报此文章

查看全部

How can you coordinate incident response with vendors, partners, and customers?

1

2

3

4

5

6

1 Define roles and responsibilities

2 Notify and inform stakeholders

3 Collaborate and coordinate actions

4 Document and report outcomes

5 Follow up and maintain trust

6 Here’s what else to consider

Information Technology

给文章评分

感谢您的反馈

更多Information Technology相关文章

更多相关阅读内容

How can you coordinate incident response with vendors, partners, and customers?

1

2

3

4

5

6

1 Define roles and responsibilities

2 Notify and inform stakeholders

3 Collaborate and coordinate actions

4 Document and report outcomes

5 Follow up and maintain trust

6 Here’s what else to consider

Information Technology

给文章评分

感谢您的反馈

查看其他技能