The recent news of a cyber incident affecting Marks & Spencer (M&S) serves as a stark reminder that in today’s digital landscape, no organisation, regardless of its size or reputation, is immune to cyber threats. While the technical teams work tirelessly to understand the intricacies of such attacks and implement necessary solutions, this incident underscores a crucial aspect often overlooked in the immediate aftermath: the vital role of clear and consistent communication.
For businesses of all sizes, anticipating the risk of cyber incidents is no longer a matter of “if” but “when.” Implementing robust cybersecurity measures is paramount, but equally crucial is the development and regular testing of a comprehensive disaster recovery plan. This plan acts as the organisation’s blueprint for navigating disruptions, ensuring business continuity, and minimising the impact on operations and stakeholders. Regular testing is the key here – it’s not enough to have a plan; you need to know it works under pressure and identify potential weaknesses before a real crisis hits.
Communication is key
The technical implications of a cyber attack can be vast and complex, demanding significant time and expertise to unravel and address. However, while IT teams are focused on remediation, other areas of the business remain equally critical, particularly communication. For a brand like M&S, which has cultivated a significant reputation for customer service built on trust and reliability, maintaining open lines of communication during such a challenging time is absolutely essential.
As highlighted in a recent BBC News article, the cyber incident has affected M&S’s online platforms impacting potentially a third of its regular trading during peak holiday season. In such scenarios, the ability to communicate effectively through alternative channels becomes paramount. The updates provided by M&S, leveraging available avenues to inform customers about the situation, manage expectations regarding potential disruptions, and raise awareness as the situation unfolds, are a critical part of their essential communication plan.
This situation also subtly reminds us that even with well-defined communication strategies, a high level of technical dependency can introduce limitations. Testing disaster recovery plans should extend beyond technical recovery to include communication protocols under various disruption scenarios. Could alternative communication channels handle the potential surge in inquiries? Are teams adequately trained to deliver consistent and accurate information when primary systems are compromised? These are the questions rigorous testing can help answer, potentially highlighting shortfalls before they become critical issues during a live incident.
What can organisations learn from M&S
The nature of the cyber incident at M&S continues to develop as investigations proceed. However, this event should serve as a powerful reminder for all organisations to proactively ensure they have the following foundational elements in place:
- Clear cyber security systems, policies, and procedures: These form the first line of defence against potential threats.
- Organisation-wide understanding and awareness: Ensuring all levels of the organisation are informed about cybersecurity risks and their roles in maintaining a secure environment is crucial.
- A clear and regularly updated disaster recovery plan: This is the roadmap for navigating disruptions and ensuring business continuity.
- Regular testing and updates of the disaster recovery plan: To ensure its effectiveness and relevance in the face of evolving threats and technological landscapes.
Information Solutions can help
At Information Solutions, we understand the multifaceted challenges businesses face in today’s interconnected world. We offer a range of services designed to bolster your resilience, including comprehensive cyber security solutions and the development and testing of robust disaster recovery plans.
If you’d like to understand more about our offerings and how Information Solutions can help your organisation proactively prepare for and respond to potential disruptions, we encourage you to get in touch.
Let’s work together to ensure your organisation is equipped to navigate the evolving landscape of cyber threats and maintain the trust and confidence of your stakeholders.