Butkus

You wouldn’t believe how many startup CEOs I talk to who would be royally screwed if one of their vendors got hacked. A few months ago, this wouldn’t have mattered for most startups. But we’re entering cyber armageddon. This is going to happen to you. It’s just a question of when. The good part is that it’s very manageable. You just need the right mindset and a few processes in place before anything happens. Here’s what I’d be thinking about today. First (don’t kill me): do you have cyber insurance? And the real question: have you ever actually talked to your broker about using it? I know this is the last thing you want to deal with, and it’s boring as hell. But please, please call them and make them walk you through it. If your cloud provider gets breached tomorrow, who do you call? What help do they arrange? What needs their approval? What do you pay out of pocket? Get the actual phone number, and save it somewhere you can reach if your work email is down. Then figure out if your lawyer handles breaches. If they don’t, ask who does and get introduced. Find out how hiring them works with your insurance. You want to know this person exists before you need them. Next, pull up your customer contracts, especially the big ones. What did you agree to tell them if something happened? You’d think every CEO would know this by heart. Almost none of them do. What triggers a notification, and who’s supposed to get it? Have someone qualified work through it with you, right now. You might have agreed to something eight months ago and forgotten. Someone at the customer may remember, and if they do and you don’t, you could be very liable. One angry customer with a contract claim can be enough to sink a startup. Same deal with any security questionnaires you filled out. What did you say you do? Are you doing it? Is it still true? Then come the business problems. How long could your product be down before you have a real cash problem? What if a big customer pauses payment while you’re also paying outside help? Run the numbers and see where things get uncomfortable. And who can spend money in an emergency? If everything needs your approval and you’re asleep or on a plane, what happens? Who can take the product offline? This came up in the replies to my last post. Rotating keys can mean an outage, and someone has to decide whether to accept it. Figure out who has that authority before it matters. Who talks to customers while your engineers are busy? Give that job to one person and make sure they get accurate updates. Otherwise your engineers are investigating while answering the same question from five people. You can draft the bones of those updates now: what we know, what we’re checking, what you need to do, when we’ll update you next. Leave room for uncertainty, and don’t promise things you haven’t confirmed (this happens more often than you think, and can get you in hot water). Have someone keep a timeline: facts, times, decisions, things you tried that didn’t work. Everyone will be tired and distracted. You will forget. And where does all of this live? If your plan, contracts, and contacts are all behind the login that’s down, you have a second problem. Try reaching what you’d need without your normal work setup. Make damn sure you can (offline copies are useful here). Take a look at what you’re exposing, too. Old customer files, exports, recordings, and especially whatever your agents can access. Do you need all of it? Who decided to keep it? Who knows everything you’ve connected, what your agents do during an investigation, and where they’re sending information? Someone needs to own those questions, because every piece of it is future work if something goes wrong. Then practice. Sit down with whoever would be involved and walk through it. At some point everyone will look at each other and nobody will know the answer. Write that down, and start there. Bookmark this so you have it when you need it.