Always Expect an Incident: Companies should test their existing capabilities and have a plan-of-action for when the worst happens. They should consistently monitor whether existing mechanisms give enough warning and are able to hold threats at bay long enough for the company to act. How early in the attack is the security team alerted? Do defenses slow the attacker, giving the team the opportunity to counterattack? Segregating networks will make it difficult for the attacker to move laterally at pace.

Create a Culture of Security: Business leaders should be vocal about the importance of cyber security across the organization, and all departments should know that cyber security is relevant to them. The Board should be briefed regularly on cyber security and security providers should be involved in this process. Ideally, the CISO should be part of the top management team. If not, key personnel within the security team should give regular briefings to the management team on how the business is responding to cyber threats.

Document, Document, Document: Attackers probably aren’t going to stop. So you should prepare your business with a continuity plan that can get you back up and running in the least amount of time, with as little amount of fuss as possible. Documentation plays a key role in that process. And not just a plan for how you will get back up and running, but also having documentation for all your business processes. Trying to remember how we’ve been doing things after a disaster has struck is usually far easier if we can look at something tangible to remind us of what steps to follow.