One component of many small business breach response plans is accessing the financial and technical support available through a well-structured Cyber Liability insurance policy. Coverage options vary widely, so businesses (or the insurance broker) must carefully examine their needs before crafting a policy. For those firms with lean internal resources and thin financial margins, the right insurance can be a key asset when it comes to implementing a solid breach response plan. Below, three steps that will help organizations mitigate data breach disruptions before they occur.

1. Assemble the team

Who needs to be involved in responding to a breach? Before attempting to pull together more than a cursory list of post-exposure action items, it's critical that the firm identify those individuals or groups that should be contacted in the event of a potential breach. The team will vary from one business to the next, but most organizations will want to include representatives from the executive group, legal (either internal or an outside consultant), privacy or information security, risk management, information technology, human resources and public relations.

Given the growing reliance on external partners — cloud providers, payroll processors and the like — firms should also consider where vendor touchpoints exist and how or when those third parties will contribute to the breach response process. They may need to be included on the contact list or they may even be responsible for raising the initial alarm if a breach occurs. It's also important to ensure vendor contracts clearly spell out the company responsible when a breach occurs and who is liable for notifying those impacted. Other vendors are also commonly part of the response team, such as media relations consultants experienced in crisis management and notification firms with the resources necessary to quickly inform breach victims about the situation.

If the business has Cyber Liability coverage, the insurance company should also be part of the breach response plan. There are support services included in many policies that will be helpful in the event of an exposure, ranging from forensic investigation teams to data recovery specialists. To maximize the value of any applicable coverage, firms must be ready to access available features quickly and through the most efficient channels.

Related: More cyber liability education needed industrywide

An ineffective breach response may mean missed regulatory deadlines, litigious victims and the company facing a host of ongoing reputational and financial damage.(Photo: Shutterstock)

2. Consider where legal obligations exist

There are laws, rules or regulations that will influence how a business's incident response plan is designed and implemented, both at the state and federal level. Often these laws cover how and when breach victims are to be notified. Timeframes are strict in many instances, so understanding all obligations in detail and incorporating them into the response plan is important if the plan is to be deployed effectively.

Those businesses that handle particular types of data, such as financial information, personally identifiable information or medical data, may have additional mandates that will guide their breach response actions. It may be necessary to notify one or more regulatory agencies or other oversight groups. Reporting of the incident may be required in one form or another, with a provision for investigative findings to be forwarded for review once the incident has been scrutinized and determinations on cause and scope have been made.

3. Create the action steps

With the team in place, it's time to identify the steps that must be taken if a breach occurs. These action items should be general enough to accommodate a range of breach types and triggers. For example, one step may be to shut down access to any compromised technology, whether that's an unsecured Wi-Fi access point or a breached server. Or the response plan may involve halting a check run if it's discovered that personalized inserts don't match the address on the outside of the envelope.

Generally, the action steps will entail a cursory investigation to find the cause of the breach, doing what's necessary to quickly plug the leak, and then look for solutions to minimize harm while notifying victims. Communication channels should also be delineated, identifying who is responsible for initiating the response plan and which functional area(s) will coordinate the activities of any third-party vendors. This ensures the right outside experts are ready to go on short notice and also avoids any time- and money-wasting duplication of efforts across the various sub-teams.

A breach response plan should be considered a living document. The first way to make it better is to test it using what's called a table-top exercise. In this exercise, the breach team is brought together and is presented with a breach scenario so everyone can run through their action items. Glitches can then be noted, solutions developed and the plan amended. Regular reviews should also be conducted so that updated processes and new threats can all be addressed.

The importance of putting a framework around these action steps can't be understated. A swift and effective breach response may mean the difference between managing the post-exposure situation in a way that mitigates harm to breach victims as well as the business itself, or bumbling through the process with missed regulatory deadlines, increasingly unhappy (and potentially litigious) victims and the company facing a host of ongoing reputational and financial damage.

Related: 5 essentials of a cyber liabiliy policy

Rich Blumberg is a business development director for IDT911.