Why Saying Breach Can Hurt Your Business
You notice unexpected login alerts for your work Microsoft account, so you report it to your managed service provider, saying “I was hacked.”
Unfortunately, the word “hacked” just started a timeline for reporting requirements your organization isn’t ready for.
IT problems should be reported to your IT staff or MSP promptly, but be careful about how you report those events, especially before you know if there even is a deeper problem.
Let’s talk about why you should avoid using the words “breach,” “hacked” and “security incident,” and discuss ways to talk about the situation without giving it a definitive label.
Calling an Incident a ‘Breach’ Starts a Countdown Clock
Depending on the industry you serve, when you declare an incident a breach or security incident, you must notify individuals, regulators and sometimes the media within a specified number of days.
For example, HIPAA rules state that individuals and the Department of Health and Human Services must be notified no later than 60 days after the discovery of a breach. HIPAA rules also state a risk assessment must be conducted to determine if the incident is defined as a breach and if notification is even required.
So, calling the incident a breach before you know what it is skips the risk assessment step and gives you less time to gather documentation for said risk assessment or cybersecurity insurance purposes.
Other industries have their own reporting requirements. And even if you’re not in a highly regulated industry, there are different requirements among states, so it’s important to know what they are for the state you reside in.
There are some proactive things you can do to improve your organization’s security posture, which will help you avoid those, “What do we call this?” moments. Our advice is to check your Microsoft Secure Score.
How To Report Incidents Without Saying ‘Breach’
When you write an email to your MSP or submit a ticket and use words like “breach” or “hacked” in writing, inadvertently or not, that is documented evidence that a discovery is known.
The key thing to remember is to describe the event as a possibility rather than a definitive. Say things like:
- “There may have been a breach.”
- “There is unusual/suspicious activity.”
- “There’s a possible security incident.”
The possibility of a breach is much different than a known breach. Making this small change will save your organization from legal escalation or regulatory headaches.
Avoid Incidents that Turn into Breaches
There are some proactive things you can do to improve your organization’s security posture, which will help you avoid those, “What do we call this?” moments. Our advice is to check your Microsoft Secure Score. A score below 70% means there are settings you can enable for free that will improve your score with almost zero disruption to your business workflow.
If you want more personalized ways to improve your score, let’s talk. We’ll discuss ways to improve security while keeping your business running smoothly and increasing productivity.
Stay updated! Get tips and insights delivered to your inbox weekly by subscribing to our newsletter.
