787 974 136
A ransomware attack paralyses a business for an average of 21 days. This is not a statistic from some distant world – it is a reality that Polish businesses face every year. For some, 21 days means serious financial losses. For others – the loss of customers, broken contracts and a reputation that cannot be restored. ISO 22301 does not protect against cyberattacks. But companies that have it recover from an attack much faster – and with fewer losses. Why?
Most companies treat cybersecurity and business continuity as two separate issues. ISO 27001 covers security, ISO 22301 covers continuity. In reality, they are two aspects of the same risk.
A ransomware cyberattack is one of the most common scenarios for business disruption today. It encrypts data, locks down systems, and paralyses production and customer service. The time needed to restore normal operations depends on one key factor: whether the company has a documented, tested action plan for such a scenario – or whether it reacts chaotically, in a fire-fighting mode.
ISO 22301 requires an organisation to identify business disruption scenarios – including cyberattacks – and to have documented continuity plans in place for them. The plan must specify: who decides to activate emergency procedures, how the company operates without access to IT systems, how and when it communicates with customers, the order in which systems and processes are restored, and what the RTO and RPO targets are for each critical system.
Hour 0 – detection of the attack. A company without a plan: chaos. The IT department tries to assess the scale of the incident, management doesn’t know what to do, and no one informs the customers. The first decisions are made under enormous pressure, without data and without clearly defined responsibilities.
A company with ISO 22301: the incident response procedure is activated. The crisis team convenes in accordance with a pre-established plan. Roles are assigned. The first actions – isolating infected systems, activating backups, notifying key customers – are carried out in parallel, not sequentially.
The first 24 hours. A company without a plan: it is still assessing the scale of the problem. A backup exists, but no one has tested its restoration. It turns out that restoring the production system will take several days, not hours.
A company with ISO 22301: the RTO for critical systems was established in advance. Backups were tested regularly – the company knows that restoring the key system will take 6 hours, as this was verified during exercises. Customers received a communication with a realistic timeline.
One week after the attack. Company without a plan: still struggling with data recovery. Some customers have left. The insurer requires documentation that the company does not have.
The company with ISO 22301: has been operating at full capacity since the fourth day. It is conducting a post-incident analysis and updating its plans. The insurer receives complete documentation of the course of events and the actions taken.
ISO 27001 protects against cyberattacks through access management, encryption, monitoring and other technical measures. ISO 22301 addresses the question of what you do if an attack is successful despite these measures.
Companies that only have ISO 27001 are like houses with a good lock – but without an evacuation plan in case of fire. Companies that hold both certificates manage cybersecurity comprehensively: they minimise the risk of an attack whilst also minimising its impact should it occur.
In practice, implementing both systems simultaneously is more effective than implementing them sequentially – the documentation infrastructure, internal audits and management reviews can be shared, and the project costs and time required are significantly lower than with two separate implementations.
DJB DORADZTWO
Marcin Chorąży
