Rebuilding Preparedness After a 20% Budget Cut

Prioritize by likelihood of failure during a real incident and cost to fix. First, fix the incident command structure: a plan with a departed commander fails at the first decision point. Assign a primary and alternate commander, define delegated authority, and publish an escalation matrix. This costs time, not money, and directly enables every other capability. Second, verify and repair the contact tree. Four disconnected numbers among 14 contacts is a 29% failure rate in the mechanism used to assemble the response team; test it with a call tree drill and require acknowledgements. Third, retest backup restoration, focusing on the two systems that failed. A ransomware event without restorable backups forces payment or prolonged outage. The 72-hour reporting obligation raises the stakes for accurate scoping, which depends on available logs and restore capability. I would defer purchasing new tooling and instead use existing EDR, SIEM, and ticketing systems to document the fixes. The reasoning is that people, contacts, and recoverability are foundational and cheap relative to their impact; a new platform cannot compensate for an unreachable commander or unverified backups.

The tabletop should test decisions under uncertainty: who declares an incident, when to isolate a claims system, how to handle a 72-hour regulatory clock when scope is unclear, and who speaks to the regulator and customers. Objectives should include validating the new incident command structure, exercising the repaired contact tree, testing escalation to legal and communications, and identifying gaps in backup restoration assumptions. Success measures should be observable: time to assemble the response team after the first inject, whether the commander and alternate are correctly identified, whether legal is engaged before any external statement, whether the 72-hour deadline is recognized from the correct awareness point, and whether every major decision is logged with rationale. Include IT operations, legal, privacy, communications, claims business owners, and the cyber insurer's claims contact. Do not grade on whether participants know a specific regulation citation; grade on whether they ask the right questions and escalate appropriately. The reasoning is that tabletops reveal coordination and decision gaps, which are the failures most likely to worsen a real incident.

Test the contact list with a no-notice call tree drill during business hours, then repeat after hours. Give each contact a unique code to return by phone or email, record time to acknowledgement, and count unreachable contacts. Update the list from authoritative HR and vendor records rather than from the old document. For backups, choose one failed system and one successful system, restore them to an isolated environment, and validate application functionality, not just file presence. Measure restore time, data loss window, and whether credentials or dependencies are missing. Repeat for the second failed system if time permits. Document the results as preparedness metrics: percentage of contacts reachable, mean acknowledgement time, restore success rate, and recovery time against the recovery objective. This is cheaper and more diagnostic than a full exercise, and it produces evidence for the CISO. The reasoning is that preparedness claims are hypotheses; contact drills and restore tests falsify them quickly and cheaply before a tabletop or real incident exposes them.