Managing incidents
Mēnā kua raru koe i tētahi maiki haumarutanga tuihono

If you have had an online security incident

Responding quickly to an online security incident can limit the impact to your business. Here's where to start.

4 min read

If you have an incident response plan prepared, now’s the time to put it in to action. If you don’t have an incident response plan prepared, that’s ok too, you can still use this guide to help navigate your response and recovery.

Creating an incident response plan

How to protect your business

  • Call in support and reinforcements

    If you don't have in-house IT expertise, call in people who can help you resolve the incident and make any technical, legal and business decisions. These people could include:

    • an IT service provider
    • a lawyer, and
    • your bank.

  • Triage and contain the incident

    Depending on the type of incident and what systems are affected, you'll need to take steps to contain the incident and prevent any further damage. This might mean temporarily shutting down or suspending some of your business operations.

    Example: Pita's company’s website host confirms an attacker has accessed the website to share political messaging. They advise shutting down the functionality while they work to resolve the issue, to prevent anything going wrong with potential online purchases and to protect customer information.

  • Tell your staff

    Once you’ve identified the incident, let your staff know what's happening, what the next steps are and who is leading the incident response.

    Make sure staff have clear and consistent information that they can use to respond to any customer or supplier enquiries. 

    Example: Pita calls a meeting with his staff to tell them about the incident and that the e-commerce functionality of website is temporarily closed until the incident is resolved. Pita appoints himself as incident lead because he is working closely with technical support. He gives the office administrator the role of communications and the first task of circulating consistent messaging that all staff can use when talking to customers.

  • Let your customers know

    It can be difficult to let your customers know about a security incident and how it might affect them. You and your lawyer need to decide who you’re legally obliged to contact about an incident. You’ll also need to decide who you’re morally obliged to contact. 

    You'll need to decide when and how to let them know, and whether you'll tell them about it even if you’re not sure they have been, or will be affected. This decision may need to be made on a case-by-case basis.

    Communicating in an online security incident

    Example: In their appointed communications role, the office administrator posts a message to the business’s social media channels letting customers know that the online shopping function of the website is temporarily unavailable while an issue is being resolved. They also ask the website host to place the same message on the website’s homepage.

  • Maintain business as usual

    To minimise the impact of the incident, try to keep the unaffected parts of your business running. You might appoint a staff member to take the lead of day-to-day operations while you focus on the incident and keep track of response and recovery process, decisions and actions.

    Example: Pita appoints the sales manager to keep the phone orders and the dispatch room running to make sure existing customer orders are fulfilled. This gives Pita time to work with the website hosting provider, focus on resolving the issue and make decisions around improving the website’s security.

  • Report the incident to CERT NZ

    Report an online issue or security incident to us at CERT NZ.

    Get help now

    After the incident

    Once the incident is resolved, there are some important last steps to round out the response. These include:

    • a debrief with staff on what went well and what could be done better
    • completing an incident report to document what happened, what decisions were made and why – this document may be helpful for any investigations or insurance claims
    • monitoring activities closely to make sure the incident hasn’t reoccurred or that any other systems have been affected by the response
    • responding to any enquiries from customers who were affected by the incident
    • updating policies or noting changes to systems as a result of the incident
    • updating, or creating, your incident response plan with lessons learned.

    Creating an incident response plan

Even if you're an IT expert, during an incident you'll need to focus on keeping your business running and managing the response, while others work to resolve the technical aspects of the incident.