How to Create a Cybersecurity Plan for Your Business

As technologies advance, so too do cyber criminals. In a recent report, small business intelligence firm UpCity noted, “Cybercrime cost U.S. businesses more than $6.9 billion in 2021, and only 43% of businesses feel financially prepared to face a cyberattack in 2022.” Cybercrime comes in all shapes and sizes. Threats include malware, phishing, ransomware, insider threats, advanced persistent threats, and more. Unfortunately, the increase in remote and hybrid work has provided criminals with an unmistakable backdoor to company systems.

With more employees working away from the office on their own networks and devices, cybersecurity must be top of mind for small and mid-sized businesses. However, executives can’t rely on guesswork and outdated processes to keep cyberattacks at bay. They must develop a comprehensive plan to prevent, respond to, and recover from cyber threats. Here are five steps to create and implement a robust cybersecurity plan.

Develop the Initial Framework

The first step to creating a cybersecurity plan is identifying what assets need to be protected. This includes systems, devices, networks, data, personnel information, and anything else a criminal could use to extort or steal from your company.

Next, determine who will be in charge of developing and implementing your cybersecurity plan. An executive member of your company should either be in charge or highly invested to ensure your efforts have the backing needed to be successful.

Once you know what needs to be protected and who will oversee your security efforts, take the time to review existing policies and identify any gaps. Determine what procedures need tweaking and which are no longer relevant. Then, integrate existing policies with any new opportunities your team has identified to create a comprehensive, well-rounded strategy.

When developing and implementing your plan, be sure to account for Microsoft’s recommended best practices, including:

• Enabling multi-factor authentication
• Applying least privilege access and securing sensitive/privileged credentials
• Isolating legacy systems
• Using anti-malware and workload protection tools
• Securing and managing systems with up-to-date patching

Finally, create a written document with your intended goals, plans, and procedures. By putting everything on paper, your team will have a helpful resource to refer to—helping them stay accountable and on track.

Ensure Devices and Systems are Compliant

Once you have the foundation of a plan in place, make sure all company devices and systems are compliant with the new and improved security policies you have instated. To do this, conduct a risk assessment test to determine what assets may already be at risk and identify areas needing the most work.

After conducting the risk assessment, ensure all devices are up-to-date with the newest Microsoft updates and security patches. Microsoft frequently updates its systems to combat new and emerging security threats, but you will only be protected if devices run on the most current versions of your software.

Moving forward, you may need to establish additional policies regarding passwords, public Wi-Fi usage, VPN usage, communications, etc. Follow up with remote/hybrid employees regularly to ensure they follow best practices.

Promote Open Communication and Training

Change management, communication and training are essential to an effective cybersecurity plan. After all, your employees will not follow your new policies if they do not know how to do so or are unaware of them to begin with.

Clearly communicate security standards and policies to all members of your organization, including C-Suite, entry-level and everyone in between. Keep employees in the loop about upcoming updates and inform them when potential security threats are discovered.

Conducting in-depth training sessions will help employees:

• Know what to look for in security threats
• Be mindful of best practices
• Understand their obligations for keeping data and information safe (such as only logging into their business account on a secure Wi-Fi connection, not opening emails or sending information without confirmation over the phone or in person, etc.)
• Know what to do and who to contact in the event of a cyberattack

Regularly Monitor Security Measures and Update As Needed

Technology is constantly evolving. Remember, as technology becomes more intelligent, so too do cyber criminals. Although your cybersecurity plan may be outstanding, you must continually monitor and evaluate your efforts to ensure all systems and critical data are protected.

Keep a close eye on basic “housekeeping” like ensuring networks and devices are encrypted, decommissioning inactive users and devices, installing antivirus and malware programs, ensuring firewall settings are optimized, and keeping everything up to date.

Your cybersecurity plan should not be a “one and done” endeavor. Instead, it should be a living document that adapts and evolves as needed.

Have a Response Plan and System Backup

Basic security hygiene will protect your systems from 98% of attacks. Unfortunately, that means that sometimes, criminals will still find a way to squeeze in through the cracks in your armor.

In the event of a cyberattack, it is essential to have a robust response plan. Ensure all critical systems are backed up (ideally on the cloud) and communicate to your team what they should do if things go south. A bulletproof response plan will minimize loss and disruption after an incident. 

Working With a Security Partner

Creating a cybersecurity plan takes considerable time and effort. If you don’t know where to start or don’t have the resources to develop and execute a plan in-house, consider reaching out to a cybersecurity managed services partner like Sikich.

A certified partner will help you understand your security risks, detect vulnerabilities in your current systems and cultivate a plan to keep your data secure on all fronts. Learn more or schedule a consultation here.