Cybersecurity Awareness Month puts a much-needed spotlight on prevention. Businesses are reminded to create stronger passwords, use multi-factor authentication, update systems, protect sensitive information, and employee phishing and security awareness training.
But cybersecurity preparation shouldn’t end with prevention.
For CPA firms, law firms, or other professional services that manage confidential client information, knowing how to respond when something goes wrong is just as important. A compromised email account, ransomware infection, stolen credentials, or fraudulent payments can quickly become a larger issue without a clear response plan.
SpotLink provides managed IT services designed to help businesses strengthen their current technology, protect sensitive information, monitor for potential threats, and respond effectively if an incident occurs.
If you suspect your business has been compromised, here is what the first 60 minutes should look like.
The First 10 Minutes: Contain The Threat
The first priority is preventing the suspected attack from spreading.
Disconnect computers that appear compromised from the network by unplugging the Ethernet connection or disabling Wi-Fi. Avoid deleting files, wiping the computer, or attempting to investigate or solve the problem yourself. These actions can destroy information your IT or cybersecurity team needs to determine what happened.
With proactive IT management and cybersecurity support from SpotLink, businesses can implement processes to identify, isolate, and respond to suspicious activity before one compromised device leads to a larger problem.
Minutes 10-20: Contact your IT Team
Resist relying on a potentially compromised email account to report the incident. Contact your IT provider directly using a known phone number or other secure communication method.
Provide as much information as you can:
- What made you suspect the attack?
- When did someone first notice?
- Which computer or accounts seem affected?
- Were suspicious links or attachments opened?
- Were there unusual login attempts, password resets, or payment requests?
Having a managed IT partner such as SpotLink means your team already knows who to contact when an IT or cybersecurity incident requires immediate attention.
If your organization is covered by cyber insurance, review your reporting requirements and contact the appropriate representative.
Minutes 20-35: Secure Critical Accounts
Once the immediate threat has been isolated, turn to account security.
Using a clean device, work with your IT team to secure potentially compromised accounts. Prioritize email, administrative accounts, financial platforms, and other systems containing sensitive information should receive priority action.
This may include ending active sessions, changing passwords, receiving login activity, checking multi-factor authentication settings, and looking for unauthorized changes.
Email deserves particular attention. A cybercriminal with access to an employee’s inbox may create forwarding rules or other settings that allow continued monitoring even after a password was changed. SpotLink’s cloud services support businesses in maintaining secure and accessible business technology.
For CPA and law firms, compromised emails can be particularly serious due to containing confidential client conversations, documents, financial information, invoices, or payment instructions.
Minutes 35-45: Preserve a Record of What Occurred
As your IT team investigates, document the incident.
Write down when the problem was discovered, what was observed, affected systems, and actions that have been taken. Save screenshots or photographs of suspicious messages, ransom notes, unusual login alerts, or error messages when appropriate.
Don’t directly communicate with attackers or make decisions without first consulting your team. Accurate documentation can help your technical teams investigate the incident and may be important when working with insurers, legal counsel, financial institutions, or law enforcement.
Minutes 45-60: Determine Who Needs to Know
Once the immediate situation is contained, determine who needs to be briefed.
Leadership should understand what occurred and the actions underway. Employees may need instructions about compromised systems, password changes, or alternative communication channels using SpotLink’s offered unified communication.
If financial fraud occurred, contact your financial institution as quickly as possible.
If there are financial implications or a suspected data breach, you should contact your attorney for legal advice.
If the breach will require customer or public disclosure, you may want to reach out to a crisis management or public relations firm to help manage the notification process.
If you have cyber liability insurance, this is where you would want to start the claims process. Depending on your policy, they may be able to help with legal and public relations costs and services.
Businesses should also report cybercrime to the FBI’s Internet Crime Complaint Center. You may want or need to contact local law enforcement as well.
Depending on the scale of the attack, there can be legal or regulatory notification requirements. Following these are important to avoid potential fines or civil or criminal charges.
Don’t Forget about Hybrid and Remote Employees
Cybersecurity doesn’t stop at the office door. Remote employees have access to company emails, client files, cloud applications, and other sensitive information from home networks, creating additional entry points.
Businesses should establish clear standards for remote employees, including: updated systems, multi-factor authentication, unique passwords, secure home Wi-Fi, reliable backups, approved devices and applications, and separating personal and business data. A strong managed IT strategy should account for employees wherever they work.
The Best Incident Response Begins Before It is Needed
Businesses should not need to figure out their response to a cybersecurity attack as it occurs.
Create a written incident response plan on how a compromised system should be isolated, to identify who employees should contact and where important numbers are stored, and which outside partners need to be notified.
For businesses handling confidential client information, such as law or CPA firms, preparation can make an immense difference when every minute counts. Cybersecurity preparation begins with understanding vulnerabilities. Contact SpotLink for free consultation to discuss your current IT and cybersecurity environment and identify areas that may need additional protection. We support 24*7 support in Great Falls, San Diego and MidSoCal.