The following are frequently recommended steps upon suspected or determined unauthorized access or use of your computer network. This includes potential theft, loss, or unauthorized access/use of sensitive, personally-identifiable information or third party corporate information in your care, custody, or control.
A successful response involves prompt coordination of resources and the actions below can help business leaders plan ahead and strengthen their response and recovery efforts.
1. Recognize the potential or confirmed cyber incident.
Mobilize your internal incident response team to gather facts to establish what happened and when it was discovered. This includes finding which systems and devices are affected and what kind of data may be impacted.
2. Notify external partners (e.g., broker, carrier, or outside counsel).
With the developing facts, contact MMA to assist in helping you notify the affected parties. Each situation is unique and can occur at all hours of the day. You may want to consider directly notifying your cyber carrier immediately using the 24/7 hotline or email.
Be mindful of utilizing electronic communications such as email if a suspected system compromise is suspected. Avoid sending copies of your policy internally or externally.
Contact a member of your carrier’s pre-approved privacy counsel with a focus on carrier consent and attorney-client privilege throughout the investigation. Coverage can be impacted if vendors are not pre-approved by the carrier and most have panel vendor requirements.
3. Seek forensics assistance if necessary.
Counsel will assist you in determining whether an external forensic firm will be needed to support your internal investigation. This will likely require approval by your carrier of the specific scope of work necessary to determine the existence, cause, and impact of the incident. This is because the data involved in the incident that will be reviewed is likely highly sensitive.
4. Conduct initial scoping calls and foster carrier involvement.
Consistent communications with the carrier representative establishes a good working relationship. Keep lines of communication open and foster collaborative investigation and response efforts. Common topics such as pre-approval of the specific forensics scope of work necessary for the investigation and self-insured retention erosion should be a top priority. MMA will continue to support you throughout the process.
Other vendor considerations In the event security breach notice law(s) require direct compliance including notification to individuals or regulatory agencies. Additional vendors may be needed to support the process and carriers often require pre-consent for vendors and public relations/crisis communication firms.
It is strongly recommended you use carrier approved incident response firms to help streamline the process and to minimize the chance of having expenses that are not covered by your policy. Please reach out to your Marsh McLennan Agency contact to report a suspected or actual cyber incident and we can help you through these steps.
