Cybersecurity planning usually focuses on preventing an attack.
But architecture, engineering, and construction firms should also ask another question:
What happens if something actually goes wrong?
A cyber incident can quickly become an operations problem. Employees may lose access to email, files, project information, or other systems they use every day.
Answering these five questions ahead of time can make the response much easier.
1. Who makes the first decisions?
Someone needs authority to make important decisions quickly.
For example:
- Should systems be disconnected?
- Should employees stop using email?
- Should a cyber insurance carrier be contacted?
- Should clients or vendors be notified?
- Can employees continue working?
Those decisions become much harder when responsibilities haven't been established beforehand.
2. How would your team communicate?
What happens if company email or Microsoft Teams is unavailable?
Employees still need instructions.
Managers may need to contact:
- staff
- clients
- subcontractors
- vendors
- insurance providers
- outside IT or cybersecurity partners
Maintaining important contact information outside the affected systems can help.
3. When was your backup last restored?
Having a backup is not the same as knowing the backup works.
Businesses should periodically verify that important information can actually be restored.
Ask your IT provider:
When did we last perform a successful restore test?
4. What work could continue during an outage?
AEC firms often work against project deadlines.
Consider what would happen if employees temporarily lost access to:
- Microsoft 365
- project files
- shared drives
- accounting systems
- cloud applications
Which work could continue?
Which projects would stop?
Which systems need to be restored first?
Those are business-continuity questions as much as technology questions.
5. Who communicates outside the company?
During an incident, someone may need to communicate with clients, vendors, insurers, legal counsel, or other partners.
Those responsibilities should not be invented in the middle of the incident.
A simple response plan should identify who is responsible for both the technical response and the business response.
Incident response for Greater Boston AEC firms
Cybersecurity isn't only about stopping something from happening.
It's also about limiting disruption when something does happen.
Architecture, engineering, and construction companies throughout Greater Boston and the South Shore should know how they would keep projects moving while their IT team works to contain and recover from an incident.
Take the 2-Minute Sitting Duck Assessment:
www.systemsupport.com/campaign/duck
Frequently Asked Questions
What is an incident response plan?
An incident response plan defines how an organization will identify, contain, communicate about, and recover from a cybersecurity incident.
How often should backups be tested?
Backups should be tested periodically so the organization knows important data and systems can actually be recovered.
Who should be involved in cyber incident planning?
Incident planning usually requires both technical and business leadership because cybersecurity incidents can affect operations, customers, vendors, insurance, and communications.
