When a major IT incident occurs, disaster recovery and business continuity plans come into their own. With a cool head CEOs, CIOs, IT directors and other key people can do a lot towards limiting damage to the business, exposure to threats, and managing the outcome of the IT incident.
As part of disaster planning it is essential to know which people to connect with during an IT incident. Some you will need to contact immediately, others can wait until the situation has been assessed and is under control. These individuals may be inside or outside your organisation, and fulfil specific roles that vary from offering practical support to ensuring regulatory compliance.
Managing A Major IT Incident: 7 People To Contact
1. Business Continuity Management Team
The members of your Business Continuity Management team need to be the first to know about any major IT incident. While smaller incidents may not need to be managed by the BCM team, it’s wise to at least consult the team leader to see what they advise.
Your BCM team should consist of senior decision makers from operations and IT, along with staff that have the knowledge and capability to action decisions made in the event of an IT incident or disaster.
If you have robust disaster recovery and business continuity plans in place, they should include whom to contact next. If not, the following teams and individuals are the people we include when helping our clients with their disaster and business continuity planning.
For more on disaster recovery and BCP see this blog.
2. The Executive Team
Your senior execs and board members will not thank you if they find out about the incident from external sources or employees. A call from the press about a data breach they have no knowledge of will not only cause them embarrassment but could also result in the wrong messages being sent to your customers and stakeholders.
Keep the Executive Team in the loop so that they can do their bit in managing both the message and providing you with support to deal with the incident quickly.
3. Compliance and Legal
Many regulated businesses, such as our clients in the legal sector, will need to report incidents like data breaches to the regulator, such as the Solicitors Regulatory Authority. From 2018 when new EU GDPR legislation becomes law, mandatory reporting to the Information Commissioner’s Office (UK) within 72 hours is also required. Failure to comply can result in significant fines, and damage the business’ reputation.
It is also important to collaborate with compliance, or legal teams, on how the incident is communicated to external parties. For example, what can be said on social media? What can customer services teams tell clients? If communications, PR, customer services, and marketing are given clear guidelines on what they can say about an incident, with proactive support from compliance or legal, it makes their job much easier.
4. Internal Comms Teams
You don’t want to be handling calls from employees unable to log on to systems while you’re trying to deal with a major incident. Therefore you should let your internal comms teams know what’s going on as soon as possible, and then they can inform employees and field their questions. You may not have much information initially, but once you’re able to provide more detail communicate this too.
A major IT incident may mean that employees cannot do their jobs, they may have deadlines they can no longer meet, they might need to reschedule appointments or the delivery of reports because they cannot access critical information. It is therefore important to manage their expectations throughout the resolution process, so they can plan too. If you have an internal comms team, they can support you with this.
5. Help Desk and Customers Services
If your IT incident affects clients your customer service team or help desk will soon know about it. They need to know what’s going on, and what they can tell clients. This can be handled by the communications team who will ensure that customer-facing employees give clients the right message and reassurance where possible.
Help desk and customer services managers may also need to bring in some extra staff to handle a spike in calls and emails. Therefore, the earlier they’re informed of an incident, the better.
6. External Comms
Your external communications team (including PR and marketing) will also be at the forefront of dealing with customers and the media. Social media is a key factor in this, with customers and media using it to air grievances and share news and developments.
If companies are not proactive in controlling the message, sharing information and responding to questions, complaints and requests for information, the impact on reputation can disastrous. Collaboration will be needed between all relevant departments and individuals to ensure that the external comms team can respond in a timely way.
7. Third-Party Service Providers
Don’t forget to let third-party service providers know if you have a major IT incident. Often their systems are integrated with yours; therefore they may not be able to provide you with the contracted service. They may even be responsible for the incident, or may have escalated it inadvertently, and so all parties need to access how it impacts on them.
They may also be able to offer you support. For example, an IT service provider may be able to offer you additional services that enable your company to get back to business faster.
If you would like to discuss any of the above in more details, please get in touch. Call 0330 124 3599 or email sales@prodriveit.co.uk
