To prepare your organization for cyber-attacks and disruptions to critical IT systems, it is important to have a clear plan on how to manage these risks. Follow the checklist below to identify vulnerabilities and strengthen your organization’s resilience.
1. identify your most important customers
Ask yourself: Who are our most important customers, and what do they depend on us for?
- Map both external and internal customers or users of your services.
- Prioritize customers based on how critical they are to the business. For example, a large customer or a strategic partner may have a higher priority.
- Define which services or products you deliver that are crucial for these customers.
Purpose:
By identifying who your most important customers are, you get a clear focus on which processes and resources need to be protected first.
2. map your critical processes
Ask yourself: What processes are critical to meeting customer needs?
- Identify the processes that are crucial to maintaining your offer. This can range from customer service and logistics to technical functions such as computer systems and access to information.
- Example: For an e-commerce company, a critical process could be order processing or warehouse logistics. For a municipality, it could be water supply or waste collection.
- Also consider indirect processes that are necessary to support the core processes, such as IT support or finance functions.
Purpose:
Understanding your key processes will help you prioritize safeguards and resources where they will do the most good.
3. map dependencies to supporting resources
Ask yourself: What resources do we depend on to keep our processes running?
- Make a list of all resources that support your critical processes:
- Technical resources: IT systems, software, networks, internet.
- Human resources: staff skills and availability.
- Physical resources: Equipment, premises, electricity supply.
- For each resource, define whether it is managed internally or supplied by an external party.
Tip:
Create a dependency map, linking each resource to the processes it supports. This will give you a clear overview of critical points in your business.
4. define acceptable downtime for critical processes
Question: How long can each process be down without causing unacceptable consequences?
- Assess how quickly a process needs to be restored:
- High priority processes: May need to be restored within minutes or hours (example: electricity supply or customer service).
- Low priority processes: Can accept longer interruptions (example: internal reporting systems).
- Document the maximum downtime for each process.
Purpose:
By defining acceptable downtime, you can set clear recovery targets and prioritize correctly in incident response.
5. Test your resilience with realistic scenarios
Ask yourself: How well can we restore our critical resources and processes in the event of various types of disruptions?
- Simulate scenarios such as:
- Ransomware attacks that lock down access to important files.
- Disruption of services from external providers.
- Loss of locally stored data.
- Evaluate how quickly you can get your business back up and running.
Tip:
Document recovery capabilities and make a clear plan describing who is responsible for what in different situations. If the simulations show shortcomings in your current solutions, you may need to supplement them with measures such as securing critical data in a separate environment, ready to be activated in case of an outage.
6. Identify and prioritize actions
Ask yourself: What actions are needed to strengthen our resilience?
- Propose concrete measures to reduce the risks:
- Implement redundant systems to ensure operations in case of disruption.
- Develop back-up procedures for critical processes, such as how to access information if IT systems fail.
- Update and test backups regularly.
- Prioritize actions based on their impact and cost.
Purpose:
Having a clear action plan will help you reduce the consequences of serious incidents.
7. Communicate requirements and test readiness
Ask yourselves: Do our suppliers and internal teams understand and accept our requirements?
- Communicate your needs and requirements to suppliers of IT systems, electricity, internet and other critical services. Ensure that contracts (SLAs) match business recovery time requirements.
- Conduct regular tests of your procedures, for example
- Simulations: Practice handling a cyber attack or a major outage.
- Scale exercises: Test the preparedness of the whole organization by simulating a crisis.
- Evaluate the results of the tests and update the procedures based on identified gaps.
Tip:
Also communicate internally so that all employees understand their roles and responsibilities in a crisis. This creates security and efficiency.
Finally, the
This checklist is a tool to identify risks and strengthen your ability to manage interruptions. By systematically addressing these points, you can protect your critical business processes and ensure business continuity, even in case of unforeseen events.
