No one in the security industry should be surprised to know that the financial and reputational impact of a breach is severe. According to a recent Harris Poll, studies show that 75 percent of consumers won't do business with a company if they don't trust it to protect their data. If the incident involves the theft of more than 1 million records (known as a mega breach), it can be almost impossible to restore the confidence levels to what they were pre-breach. In 2017 alone, there were 16 mega breaches.

Being prepared for the worst before it even happens can minimize the damage in the event of a cybersecurity incident. To get any company ready for a cybersecurity event, the first step is to organize a team to write a mock breach notification letter. For this to be successful, you must shock the organization from the top down. Too many table tops and incident planning exercises start from the bottom up and do not represent the gravity of a beach—but not this. The product of this exercise, a simple letter, will represent your message to the world about your failure in the event you have a breach. It fundamentally provides the introduction of your problem to the world—how will you be judged?

Before Beginning the Exercise

While preparing to write your mock breach notification letter, you should be asking yourself the hard questions about what to do, what you will need, and who is responsible if your organization is the one to experience a significant data breach. Even though the actual details of the letter will differ depending on the actual incident, being organized and prepared will enable an organization's team to issue a real breach notification letter in a timely fashion. A rapid response can help solve the incident at hand and build back trust in the brand. Thematically auditors and lawyers will judge your decisions prior; however, your clients, customers, and partners will judge you on your response.

When asking these questions before writing the letter, a company will likely discover that significant internal communications work is required. The person briefing groups about the incident and writing the letter should use plain language so everyone in the company can understand, especially higher-level executives who may not have a background in breach response or security operations. It is important to explain the technical aspects and incident response, the long-term impact of a breach and what it could mean to the organization as a whole. For readability, asking someone who does not have a strong technical background to draft the letter may be the best option, however, always work from the same source of truth—generally the investigative team.

Introducing The Response Team and Opening The Letter

Once company executives have been briefed on the incident, they must establish a point of contact customers can go to with any questions or concerns; this is client management to a degree never experienced. Ensure that both the legal and client management teams understand the details of the breach first. The legal team will ensure that the company notifies customers within compliance standards in accordance to the specific business location, as well as provide review of the actual data breach notification letter. Client management can work closely with the legal team to provide feedback on the customer notification process as well as act as a vessel to see how the customers are feeling after the incident. Expect a difficult renewal processes for 12 to 36 months.

Establish a team and ideally a special call center for these groups and include their contact information as the first element of the letter. Additionally, host status calls for all current clients. Expect them to go beyond the allotted times and many technical questions. As a result, they must be attended by client management, an ELT member, and a technical resource from the security team (that has been briefed and had some type of media training).

Elements of the Security Incident

Next, the letter should share information about the breach so customers can be briefed on exactly what happened. First, include the basic details:

• When your company discovered the breach;
• Known duration of the event; and
• A high-level description of the information involved.

After, move into the specifics on the event itself, which will include:

• A basic description of how the breach occurred and how many people were affected;
• How your company is responding to the incident;
• A comment about the outside help involved (government, law enforcement, investigative and response experts);
• A description of ongoing plan, with when and how updates will be provided; and
• Advice on how the customer should proceed if action is required.

As time goes on the following information will be helpful to share:

• Information on the perpetrator of the incident (difficult and dangerous, but valuable to share if criminal, nation state, etc.);
• Information on the scope of known harm, such as further problems caused by the breach, adversary activity, known fraud, etc.; and
• Information on how maturity and efficacy of the security team has improved.

Tip: The person drafting the letter should ask themselves what they would want to know if they had their personal data compromised. Most, including law makers and politicians, expect to see credit monitoring services, but it really provides little net value prevent downstream misuse.

Lessons from Mock Breach Notification Letters

It may take several months for an enterprise to perfect its letter. The exercise itself is a starting point, a way to ensure the right people are in the loop, understand what information they need to know and have a template for the letter to ensure responses are quick and efficient.

During a company's process of creating their mock letter, they will undoubtedly expose weaknesses in their systems, procedures, policies and responsibilities. This gives an organization time to start addressing these problems before disaster mitigation and response actually occurs. By going through this process, a business ensures that when they do issue a real notification letter they will be prepared to answer any questions from employees or customers.

Steve Moore serves as the chief security strategist at Exabeam, the smarter SIEM company, and is responsible for driving solutions for threat detection and response, as well as advising customers in breach management and program development.