A global manufacturing company is updating its crisis management plan. The plan must address the unique challenges of a cyber-related crisis, such as a ransomware attack that encrypts critical production systems. Which TWO of the following are the MOST important elements to include in the crisis management plan for this scenario? (Choose two.)
Trap 1: A schedule for regular vulnerability scanning of the production…
Vulnerability scanning is a preventive control, not a crisis management element. The crisis management plan addresses response and recovery during an incident. While scanning can reduce the likelihood of an attack, it does not help manage the crisis once ransomware has encrypted systems. Therefore, it is not one of the most important elements for the crisis plan.
Trap 2: A list of all employees who have access to the production systems.
An access list is part of identity and access management, not crisis management. During a ransomware attack, the priority is containment, recovery, and communication. Knowing who has access may help with forensics, but it is not a primary crisis management element. The plan should instead focus on decision-making and communication protocols.
Trap 3: A detailed inventory of all hardware assets and their physical…
While asset inventory is useful for recovery, it is not a crisis management element specific to a ransomware attack. The crisis plan focuses on coordination, communication, and decision-making. An asset inventory is typically part of configuration management or disaster recovery planning. In a cyber crisis, knowing where hardware is located is less urgent than containing the malware and communicating with stakeholders.
- A
A communication strategy that includes pre-approved messages for internal staff, customers, and regulators.
Pre-approved messages enable rapid, accurate communication during a ransomware crisis, maintaining trust and meeting regulatory notification requirements. Stakeholders need timely information to take protective actions and manage expectations. This element is crucial because communication failures can amplify reputational damage. It ensures that the organization speaks with one voice and avoids misinformation.
- B
A schedule for regular vulnerability scanning of the production network.
Why it fails: Vulnerability scanning is a preventive control, not a crisis management element. The crisis management plan addresses response and recovery during an incident. While scanning can reduce the likelihood of an attack, it does not help manage the crisis once ransomware has encrypted systems. Therefore, it is not one of the most important elements for the crisis plan.
- C
A predefined decision matrix for isolating affected network segments and invoking the disaster recovery plan.
A decision matrix helps crisis leaders quickly determine when to isolate systems and activate the DRP, minimizing spread and downtime. In a ransomware attack, speed is critical; predefined criteria reduce confusion and ensure consistent actions. This element directly addresses containment and recovery, making it essential for the crisis management plan. Without it, response may be delayed, allowing the attack to escalate.
- D
A list of all employees who have access to the production systems.
Why it fails: An access list is part of identity and access management, not crisis management. During a ransomware attack, the priority is containment, recovery, and communication. Knowing who has access may help with forensics, but it is not a primary crisis management element. The plan should instead focus on decision-making and communication protocols.
- E
A detailed inventory of all hardware assets and their physical locations.
Why it fails: While asset inventory is useful for recovery, it is not a crisis management element specific to a ransomware attack. The crisis plan focuses on coordination, communication, and decision-making. An asset inventory is typically part of configuration management or disaster recovery planning. In a cyber crisis, knowing where hardware is located is less urgent than containing the malware and communicating with stakeholders.