Cyber confident? Learn how to mitigate IT disruption even further.

By Kris Lovejoy, Global Cybersecurity and Resiliency Leader at Kyndryl

Are organizations really prepared for IT disruptions? Most companies think so.

According to a new Kyndryl survey, 88% of respondents said their organization is well prepared to manage and recover from any adverse conditions, cyberattacks or compromises that disrupt their IT assets. However, there’s a disconnect between overconfident thinking and the reality that 92% of respondents said their organization experienced adverse events in the last two years.

Kyndryl surveyed 300 IT decision-makers from large enterprises to learn about the adversity they’ve faced, the risks they’re most concerned about and their cyber resilience strategies — meaning how well they can anticipate, protect against, withstand and recover from disruptions.

How organizations manage cyber risk is within their control to an extent. Whether organizations see a long road ahead in managing IT risks or feel confident they are on their way to success, there’s an opportunity to justify this confidence.

Here are seven strategies organizations can take to chart a path toward cyber resilience.

1. Engage the business from the start — and break down silos  

IT organizations too often operate in a silo, separate from other parts of the business. The surest way for a cyber resilience strategy to succeed is to break the silo. Invite people who aren’t in IT to the table and anchor conversations about cyber resilience in the organization’s mission. Make resilience part of the organizational culture

2. Take inventory 

Many organizations are challenged by an ever-expanding and complex IT footprint. It’s important to identify and map critical IT assets that will sustain and move business objectives. These assets will be the top priority to protect and, at worst, recover following an adverse event.

3. Move to a zero-trust framework 

It’s important to have a deny-by-default standard to ensure that only those who need to access systems can get it, while those who do not need to, can’t.

4. Establish a crisis management plan — and drill it  

Sometimes adverse events are unavoidable. Case in point: human error is the most anticipated cause of IT disruptions. Defining roles and responsibilities across teams, establishing a communication process, documenting processes and improving transparency often helps reduce the impact of an adverse event. Once a plan is created, it’s important to test it regularly.

5. Continuously modernize your cyber resilience strategy 

Business goals shift, IT estates becomes more complex and external forces like regulations can require changes. To ensure your cyber resilience strategy is effective, these foundational steps must be part of an ongoing discussion.

6. Implement a robust cyber incident recovery plan 

As digital transformation and hyper-convergence create unintended gateways to cyber risks, vulnerabilities, attacks and failures, a cyber resiliency strategy quickly becomes necessary. A cyber resiliency strategy helps organizations reduce risks, financial impact and reputational damages.

7. Inform management and the board of directors often 

Most important, do not wait until it is too late. Keeping company leadership and its respective board informed about cyber events and other IT risks — including plans to mitigate those risks — can help drive top-down organizational alignment and the changes necessary to ensure cyber-enabled systems can remain operational during adverse events.

With a strong cyber resilience strategy in place, companies can keep pace with the rapidly evolving digital environment and the increasingly more sophisticated cyber threats, while also ensuring swift recovery in the event of an attack.

In recognition of Cybersecurity Awareness Month, this is the first installment of a weekly series in October that highlights how organizations can anticipate, protect against, withstand and recover from cyberattacks.

Kris Lovejoy

Global Security & Resiliency Leader