Business continuity plan for a cyberattack

A cyberattack can disrupt essential business operations within minutes. Billing, shipping, customer service, and access to information can all be affected if systems become unavailable.

Having backups helps recover data, but it does not guarantee that a company can resume operations quickly. To minimize the impact of an incident, businesses need to identify which processes must be restored first, how long they can remain disrupted, and what alternatives are available while systems are being restored.

A business continuity plan for a cyberattack helps establish these priorities and coordinate the response to reduce downtime, financial losses, and the impact on customers and suppliers.

What is a business continuity plan, and what is it for?

A business continuity plan defines the procedures, resources, and responsibilities needed to maintain or restore essential business processes following a major disruption, such as a ransomware attack, an outage affecting cloud services, or an incident involving a supplier.

It differs from a disaster recovery plan (Disaster Recovery Plan), which focuses primarily on restoring technology systems and data. Business continuity also addresses people, processes, and alternative arrangements needed to keep services running while the infrastructure is being restored.

Its goal is to minimize downtime, establish recovery priorities, and prevent decisions from having to be improvised during a crisis.

Which cyberattacks can disrupt business operations?

Not all incidents have the same consequences. Identifying threats that could affect critical business processes helps organizations prepare an appropriate response.

Ransomware and critical system lockouts

A ransomware attack can encrypt files, disrupt applications, and make essential systems inaccessible. In some cases, cybercriminals also attempt to delete or compromise backups to make recovery more difficult.

Cybersecurity incidents involving suppliers

A company may lose access to essential services if a technology provider, payment platform, or cloud service provider experiences an outage. That is why the plan should account for external dependencies and identify alternatives for keeping critical processes running.

Stolen credentials and loss of access to cloud services

Compromised administrative accounts can prevent access to corporate email, documents, applications, and collaboration tools. Having alternative communication and recovery procedures helps coordinate the response when normal channels are unavailable.

How to develop a business continuity plan for a cyberattack

An effective plan must reflect the company's actual processes and risks. These are the main elements to define.

1. Business impact analysis

Identify the company's most important processes, the systems they depend on, and how long they can remain unavailable. Also, define temporary alternatives, such as manual procedures or alternative customer service channels, to keep essential services running during a disruption.

2. Defining recovery time and recovery point objectives: RTO and RPO

Two metrics help establish recovery objectives:

• RTO (Recovery Time Objective): The target maximum time for restoring a system or process after a disruption.
• RPO (Recovery Point Objective): The maximum amount of data loss the company can tolerate, expressed as the period of data that could be lost.

These objectives should be defined according to the criticality of each process. Not every application needs to be restored within the same timeframe or requires the same backup frequency.

3. Response procedures and system isolation

The plan should specify who makes decisions, how incidents are reported, and which measures can be taken to contain them. Depending on the situation, it may be necessary to isolate compromised devices, revoke credentials, or restrict connections to prevent the incident from spreading.

These actions must be coordinated with incident response procedures and carried out in a way that avoids unnecessarily disrupting other essential systems.

4. Backups and recovery testing

Backups must be protected against unauthorized access and potential attempts to delete or encrypt them. An appropriate strategy may combine multiple copies, different storage media, and an isolated or immutable copy.

The 3-2-1-1-0 rule is a useful reference for organizing backups: three copies of the data, stored on two different types of media, with one copy kept off-site, another isolated or immutable, and zero errors detected during verification. The key is to adapt this strategy to the company's needs and regularly test whether data and systems can be recovered.

5. Crisis communication and responsibilities

During an incident, employees need to know what to do and whom to notify. The plan should define responsibilities, key contacts, and alternative communication channels. It should also establish how customers, suppliers, and authorities will be informed when necessary.

It must also account for applicable notification requirements, such as those that apply when an incident affects personal data or services subject to regulatory requirements.

What do cybersecurity regulations require regarding business continuity?

Operational continuity is addressed by several regulatory frameworks, although specific obligations depend on the type of organization, its industry, and whether it falls within the relevant scope.

• NIS2: Includes business continuity, crisis management, and incident recovery among the cybersecurity risk management measures required for entities within its scope.
• DORA: Establishes digital operational resilience requirements for financial entities subject to the regulation, including continuity, response, and recovery plans for ICT-related incidents.
• GDPR: Requires security measures appropriate to the level of risk, including, where applicable, the ability to restore the availability of and access to personal data following a physical or technical incident.

Documentation alone does not demonstrate that a company is prepared. Recovery tests, procedure reviews, and recorded results help verify that the measures work and identify areas that need improvement.

How does managed cybersecurity help maintain business continuity?

A business continuity plan requires preventive and detection measures to help reduce the likelihood and impact of an incident. It also requires ongoing vulnerability assessments, endpoint protection, and checks to ensure that recovery procedures remain effective.

At ESED, we help businesses improve their prevention, detection, and response capabilities through managed cybersecurity services, continuous monitoring, endpoint protection and XDR, vulnerability management, and security testing.