Five Questions Clients Asked Most Often In 2015 About Incident Response

We provided incident response and incident response preparedness services to hundreds of companies in 2015. The questions we answered were as unique and varied as the incidents companies faced. Some were challenging, and occasionally they were easy to answer (e.g., Can we create a fake employee to sign the notification letter?), but often they were focused on what practical steps companies can take to be better prepared to respond, how to make certain decisions during an incident, and what is likely to happen after disclosing the incident.

(1) If incidents and attacks are inevitable, what preparedness steps should be taken? We talk to companies about being "compromise ready"—a constant state of diligence focused on prevention and improvement of response capabilities. The areas of preparedness that go into becoming compromise ready include: (1) preventative and detective security capabilities; (2) threat information gathering; (3) personnel awareness and training;