The Change Healthcare Attack: Why Catastrophe Planning Needs to be Part of Third-Party Incident Response

Best Practices for Third-Party Catastrophe Planning

Having a plan in place if a catastrophe affects one of your critical vendors is a vital part of third-party incident response. As with developing a third-party incident response playbook, creating and implementing an effective catastrophe plan has a few key steps:

1. Form a cross-functional team. Effective catastrophe planning requires a cross-functional team within the organization. This could be the same team responsible for incident response or include team members at more senior levels because responding to a catastrophe may require executive decisions. Consider including IT security, risk management, legal, and procurement or supply chain management teams.

2. Define roles and responsibilities. Catastrophic events require clear lines of responsibility and communication. You should already have a business continuity and disaster recovery plan in place in case of a severe cyberattack or event related to your own company. The roles and responsibilities of the cross-functional team in that plan could relate to a catastrophic event at one of your vendors or suppliers too.

3. Create a list of alternative solutions. A catastrophic event at one of your vendors might require you to pivot to an alternate solution. For example, some healthcare providers took loans out to pay their staff when Change Healthcare went down. Having a list of other options in place if one of your critical vendors or suppliers is no longer operational can ensure your business continuity. It’s also necessary for the most effective response.

4. Run tabletop exercises for catastrophe response. One of the most important things to do with catastrophe planning is to regularly run exercises for the response team. This goes beyond an incident response playbook where everyone knows their roles. Catastrophes are so infrequent that not practicing the steps for how to respond could lead to losing precious response time. This is what the Federal Emergency Management Agency (FEMA) does for its crisis responders and what the New York Police Department’s Crisis Intervention Team does to prepare for incidents in New York City. While a catastrophic event at a vendor may not be life or limb, it’s still necessary to run practical exercises so the response team knows what to do.

5. Continuously monitor for possible catastrophic events. Organizations cannot rely on vendors or suppliers to understand what is or is not catastrophic or promptly report it. It is therefore essential to continually monitor critical third parties for new and emerging threats. While this may seem obvious, it can be a monumental task for organizations with large vendor ecosystems. Instead of trying to manually stay on top of security news and community postings, look for threat intelligence providers that can automate and scale the monitoring process for you.

Next Steps for Improving Third-Party Business Continuity

An effective third-party business continuity plan requires collaboration between internal and external stakeholders. It’s only through working in concert with their vendors to develop cohesive strategies that companies will ensure they can remain in operation during a catastrophic event.

Business continuity procedures incorporate the following activities:

• Incident detection
• Incident monitoring
• Internal communication
• Interaction with relevant national and/or regional risk advisory systems and/or groups
• Communication with emergency responders or law enforcement
• Assuring the means of communication during a disruptive incident
• Recording of relevant and vital information about the incident, including related decisions and actions

Organizations need to develop processes related to business continuity, as well as a cohesive plan to follow during a catastrophic vendor event.

How Prevalent Helps

The Prevalent Third-Party Risk Management Platform serves a key role in that business continuity plan. With our capabilities around continuous risk monitoring as well as profiling and tiering, Prevalent ensures that security and procurement teams can visualize risks, communicate with impacted vendors, and assess the risks of working with each third party.

Prevalent’s vendor threat monitoring solution ensures that companies of all sizes can accurately track possible risks to their critical vendors. This enables them to determine what sort of risk they may be facing as well as understand early signals of a possible catastrophic event.

Prevalent has also developed a business continuity plan template to help define the policies and practices that will apply during a catastrophic vendor event. Having this plan in place ahead of time is critical in an environment where it’s impossible to predict the next catastrophe that could hit your vendor ecosystem.

For more on how Prevalent can help your organization develop a comprehensive third-party business continuity plan, request a demo today.