A cyber incident can happen to anyone. That's why it's important to practice regularly. Get in good shape with tips from crisis expert Jori Kalkman (Defense Academy). He analyzed hundreds of crisis approaches to see how operational crisis teams dealt with dilemmas. He gives 5 tips on how to act during a cyber incident.
"Realize: information is a luxury during a crisis. Professionals often like to gather as much information as possible to build the best possible picture. You can waste a lot of time with that. Ultimately, a crisis is by definition uncertain and unpredictable. When you think you have a good information picture, that information is already out of date. So you have to decide and act very quickly on the basis of information that may later prove to be incomplete."
"If you can solve a crisis exercise according to the plans, then you have not had a good exercise. Therefore, consciously use an exercise to experiment. Dare to let go of protocols and plans here and there if you feel the situation calls for it. After all, that's what people are going to do in crisis situations."
"The experiments and letting go of the plans produce interesting discussions. Especially also for administrators. Consider what level of violation do we find acceptable? How much freedom can and do we want to give our employees? What do we do if, in the crisis, norms and values that we consider important are compromised? Governments like to work according to plans and protocols. This allows them to justify certain choices. But in a crisis, those same plans and protocols will not suffice."
"Stick to managerial choices: set goals, but leave the how and execution to others. A certain amount of autonomy and trust in the people doing the work is incredibly important. For example, a mayor can decide to evacuate during a flood, but should not be concerned with how that evacuation is carried out. That's not his job."
"Driver, also ask the question: when is a crisis resolved? When an area floods, you can rescue people, pump out the area and return to the old normal. With the first rainstorm, however, the area floods again. The same goes for a cyber crisis (exercise). A cyber crisis should be seen as a symptom; a warning that there may be something structurally wrong in your organization, a weakness in your systems. People feel relieved when the crisis situation is over. But actually that's when the real work begins."
