Let me get straight to the point-a cyber incident isn’t a “what if”-it’s a “when.” No organization is immune, no matter how fortified its defenses may seem. Yet, time and again, boards underestimate the brutal reality of a cyber breach, treating crisis response as an afterthought rather than a core duty. That mindset is a recipe for disaster.

If your board isn’t prepared to respond swiftly and decisively to a cyber incident, you’re gambling with your reputation, shareholder trust, and, frankly, your job security.

Here’s the Hard Truth about Cyber Incidents

  1. They Are Inevitable.Today, every organization is under siege. Hackers evolve faster than most companies can patch vulnerabilities. Preparation isn’t an option; it’s an obligation.
  2. Response Time is Everything. In a crisis, the first 24 hours make or break the impact. If your board is fumbling for answers or, worse, unaware of the response plan, you’re already too late.
  3. It’s Not Just an IT Issue.Cyber incidents are enterprise-wide crises. This is not “let the tech team handle it” territory. Every director needs to understand their role in containment, communication, and recovery.

Cyber threats aren’t just technical challenges - they’re strategic risks that require decisive board-level leadership.

Mr. Strategy Tweet

Here’s What Your Board Needs to Do (Now)

  1. Get Briefed and Stay Informed. Understanding the basics of cyber risk is no longer optional. Schedule regular briefings on emerging threats and your organization’s vulnerabilities. Ignorance isn’t bliss - it’s a liability.
  2. Define a Clear Incident Response Role for Every Board Member. When an incident hits, confusion isn’t an option. Know the chain of command. Be clear on who handles what, from media inquiries to regulatory disclosures.
  3. Build a Communication Protocol. Silence during a crisis is perceived as incompetence. Develop a communication strategy now, with clear messaging for stakeholders, regulators, and the public. Don’t leave this to chance.
  4. Demand Regular Cyber Drills. Theory is cheap; practice isn’t. Demand regular cyber incident response drills. Test the plan, find the gaps, and ensure every director understands how to execute their part. Only then will the boardroom be ready for the real thing.

    Cybersecurity isn’t just an IT function-it’s a board’s fiduciary responsibility. A breach will challenge your reputation, resilience, and readiness. The time to prepare isn’t during the crisis; it’s now.

    Take Action Today-put cyber incident response and crisis management front and center on your board’s agenda. Because in a world where breaches are inevitable, a strong, prepared board is the best line of defense.

Boards should receive quarterly cybersecurity updates, including threat intelligence and risk assessments. Be prepared, be resilient

Mr.Strategy Tweet

A case study (our case studies are actual events, with changed identities).

The data breach that shook TrustBank

In early 2023, TrustBank (not real name), a mid-sized financial institution in Kenya, fell victim to a sophisticated cyberattack. Hackers gained access to customer data, including sensitive personal and financial information, by exploiting a vulnerability in an unpatched third-party vendor software.

The incident unfolded in stages

  1. Day 1, Breach detected. TrustBank’s IT team identified unusual network activity. The initial investigation revealed unauthorized access to customer records. The breach was immediately reported to the board, but confusion about the incident response plan led to delays in containment.
  2. Days 2-4, Response and escalation. Due to a lack of clear protocols, internal communication broke down. Directors were unclear about their roles, and the CEO’s attempt to control the situation led to mixed messages. As a result, the bank struggled to formulate a unified response through the PR and communications office.
  3. Day 5, Public disclosure. After pressure from regulators and a leak to the media, TrustBank made a public disclosure about the breach. Customers panicked, and withdrawals surged. The bank’s failure to communicate early and transparently worsened the public’s reaction.
  4. Weeks following- Aftermath. TrustBank faced a 25% drop in customer trust scores, substantial regulatory scrutiny, and a significant financial impact from legal fees, fines, and lost business.

Despite efforts to rebuild trust, the bank’s reputation remained damaged, highlighting the critical role of proactive and coordinated crisis management.

Questions

  1. Pre-crisis preparedness
    1. How could TrustBank have better prepared for this cyber incident? What steps should the board have taken in advance to ensure swift, coordinated action?
    2. What protocols, if any, would you put in place to ensure vendors meet cybersecurity standards?
  2. Incident response and decision-making
    1. How did the lack of role clarity and communication protocols contribute to the chaos during the crisis?
    2. What roles should the board, CEO, and key departments have played to manage the crisis more effectively?
  3. Communication strategy
    1. At what point should TrustBank have communicated with the public, and how could this have impacted customer trust?
    2. How important is a proactive communication strategy in mitigating reputational damage, and what would you suggest as best practices?
  4. Post-crisis learning and improvement
    1. What immediate steps should the board take post-crisis to prevent a similar situation?
    2. How can regular cybersecurity drills and board involvement in these exercises improve readiness for future incidents?
  5. Governance and oversight
    1. What lessons can be learned about the board’s role in cybersecurity governance?
    2. What ongoing measures should boards adopt to ensure they’re effectively overseeing cybersecurity risk?

Suggested insights for your effective incident response 

  1. Pre-crisis preparedness

Better preparation

TrustBank should have had a well-defined incident response plan approved and understood by the board and executives. A proactive approach would include routine cybersecurity briefings and risk assessments, particularly with third-party vendors, to identify potential vulnerabilities.

Vendor cybersecurity standards

 TrustBank could establish vendor security requirements as part of their procurement policy. Vendors should be subject to regular cybersecurity audits and provide certifications or assurances that they adhere to the bank’s security protocols. Including cybersecurity clauses in vendor contracts could also reduce exposure.

  1. Incident response and decision-making

Role clarity and communication

The confusion during the crisis stemmed from unclear roles and responsibilities. TrustBank should establish a crisis response protocol that designates specific responsibilities to each board member, the CEO, and department heads. This clarity would ensure swift decision-making and accountability.

Effective roles

The board should have focused on strategic oversight, while the CEO led the crisis management effort. Key departments, including IT, legal, and communications, should have been actively involved, with their actions aligned through the incident response plan. The board’s role would include authorizing urgent decisions, providing resources, and communicating with regulators.

  1. Communication strategy

Timing and customer trust

TrustBank should have communicated proactively with customers and regulators within the first 48 hours, once they verified the breach. Clear, early communication could have managed public expectations and mitigated panic. Prompt, transparent disclosure is critical to maintaining trust.

Proactive communication best practices

A well-prepared crisis communication strategy includes a templated response framework for various types of incidents, pre-written statements for media and social platforms, and identified spokespersons. Regular media training and messaging templates enable consistent and quick responses in crises.

  1. Post-crisis learning and improvement

Immediate post-crisis steps

The board should initiate a comprehensive post-mortem review of the incident to identify what went wrong and where the response lagged. Based on these findings, they could revise the incident response plan, implement cybersecurity training across departments, and review vendor risk management practices.

Cybersecurity drills

Regular cybersecurity drills, including simulations for board members, can improve overall readiness. These drills should involve testing response protocols, communications strategies, and decision-making processes. The board’s participation reinforces their commitment to cybersecurity and ensures familiarity with the response plan.

  1. Governance and oversight

Lessons for the board

This incident highlights the board’s crucial role in cybersecurity governance. Board members must understand cyber risks, allocate resources for cybersecurity, and actively monitor vulnerabilities and compliance with security standards.

Ongoing measures

Boards should receive quarterly cybersecurity updates, including threat intelligence and risk assessments. Engaging cybersecurity consultants for independent audits, requiring regular incident reports, and establishing a cybersecurity subcommittee can strengthen oversight. Furthermore, fostering a culture where cybersecurity is seen as everyone’s responsibility reinforces an organization-wide commitment to resilience.

Cyber threats aren’t just technical challenges-they’re strategic risks that require decisive board-level leadership. Don’t wait until your organization faces a crisis to recognize the need for robust cyber oversight and an ironclad incident response plan.

Equip your board with the tools, training, and protocols needed to act swiftly and confidently when it matters most. Schedule a cybersecurity governance session today to fortify your board’s understanding, define clear crisis roles, and build a proactive communication strategy.

Be prepared, be resilient. Contact us now to empower your board against tomorrow’s cyber threats.

Copyright Summit Consulting 2024. All rights reserved. You are free to share or forward with appropriate retribution.