It is an extremely rare opportunity to get your executive management team (EMT) in one place for two hours focused on cyber security. While it meets the audit requirement, these are not technical or tactical audiences. Top Down (starting at the Board), Risk Based (validated by the EMT), and Business Due Diligence are the focus of our effective management TTXs.
With over a decade of experience conducting management TTXs, we’ve witnessed businesses’ overlooked needs related to cyber security: increased role/participation from the Board, unidentified or inconsistent understanding of risks (occasionally “business extinction” risks) throughout the organization, and protecting your brand in the age of social media, along with myriad contractual and statutory concerns.
Before an incident occurs, organizations should develop a Cyber Incident Response Plan (CIRP). Make sure the CIRP covers more than just IT. The CIRP should be Top Down so that it addresses all the expectations and concerns of the management team. We’re also seeing Board of Directors involvement due to recent SEC guidance. If you are a public company, your corporate annual report is a good place to start. You should test the CIRP to make sure it meets the needs of the entire organization. This is usually accomplished by a tabletop exercise (TTX). These are an annual requirement if you are an audited entity. You should also maintain and update the CIRP regularly. This results in a Lessons Learned program. McCarthy Cyber Readiness helps you cover all these steps so you’re ready before the crisis hits.
Our cybersecurity TTXs are engaging for every participant — and valuable long after they’re over. We start by understanding your cyber risks and your current IR related documentation. We then focus on understanding your key objectives prior to developing a scenario that guides your team in not only evaluating what they need to do, but when they would consider executing their responsibilities.
Conducting over 400 management tabletop exercises (TTXs) over the last 10 years, McCarthy Cyber Readiness has successfully delivered TTXs for executive management that do more than just meet audit requirements. We do not sell an appliance or incident response (IR) service. We have no motives other than preparing organizations to respond to crises.
A cyber incident isn’t the time to discover your plan’s weak points. Our cybersecurity tabletop exercises give your leadership team the clarity and confidence to act decisively when the stakes are highest. Schedule your session now, because the best time to prepare is before the breach.
