When it comes to a security event or breach, it isn’t a matter of “if” but “when”. No one is immune, no one is 100% secure. Any breach regardless of the type or size can be potentially devasting and the catalyst for breaches continuing to emerge and intensify. 2021 is said to have been a breakout year for ransomware as the cybersecurity attack vector of choice; affected all industries and even single individuals. We now have Ransomware as a Service (RaaS), a pay-for-use malware. The third quarter of 2021 touts an unprecedented surge of unique phishing websites – an increase of over 400 thousand. And if all that isn’t enough, business email compromise (BEC), another damaging form of cybercrime has exploded on the scene. The outcome of an attack can result in huge financial losses but that isn’t the only concern, what about reputation risk?

Financial institutions are particularly vulnerable by the very nature of the business. You have information that thieves want, the information they can parley into cold hard cash, if not the cash itself. Your incident response plan should provide confidence that you have the right personnel and procedures in place to deal effectively and timely to s a security breach. And if that isn’t enough, the financial services industry is mandated to implement security controls and a framework for identifying potential risks, monitoring for and detecting unauthorized access mitigating the outcome, effectively responding to the event, and notifying customers, law enforcement, and regulators when it does happen. Be sure that examiners will be looking at your Plan.

The incident response plan shouldn’t be just a checklist. You need well-thought-out detailed procedures/response steps that have been practiced and tested to ensure you are as prepared as you can be when a security breach happens.