Mickom

Cyber First Aid

A practical place to start when cybersecurity feels uncertain

Cyber incidents rarely arrive with a clean diagnosis. You may be trying to prevent the next problem, wondering whether something is happening now, or figuring out what needs to change after an incident. Start with where you are.

This page is general practical guidance. It does not determine whether your organization has been compromised, and Mickom is not an emergency incident-response service, a forensic provider, a legal adviser, or a security hotline.

If something may be happening now, contact the people who can act: your internal IT or security team, your provider, your cyber insurer, and your legal counsel.

Prepare

Before anything happens

  1. Is MFA required for important accounts?

  2. Are critical systems and software kept current?

  3. Are backups maintained, and has someone tested a restore?

  4. Do employees know how to report suspicious email or account activity?

  5. Is administrative access limited to people who need it?

  6. Does everyone know who the first call is if something happens?

  7. Is there a basic incident-response and business-continuity plan?

Your answers do not tell us how secure your organization is. They can help identify where a useful next action or conversation may need to start.

Respond

When something may be happening now

While you are getting the right people involved, here are several things leadership should consider.

  1. Isolate what is clearly affected when practical

    Avoid unnecessary actions that may destroy useful evidence.

  2. Activate the right response contacts

    This may include internal IT or security, an MSP, an incident-response provider, your cyber insurer or breach hotline, leadership, and legal counsel.

  3. Preserve what you know

    When the issue was noticed, affected systems or accounts, alerts received, and actions already taken.

  4. Consider a clean communication channel

    If organizational communications may be compromised.

  5. Determine reporting and notification obligations using authoritative guidance

    Requirements depend on the facts, jurisdiction, contracts, and regulatory environment.

Recover

Five questions for leadership

  1. Are we confident the immediate threat is contained?
  2. Which business or mission-critical capabilities have to be restored first?
  3. What people, customers, partners, data, services, or obligations may have been affected?
  4. What allowed the incident to happen or made the impact worse?
  5. What must change before leadership considers this issue closed?

The wider picture

The cyber problem may not be only a cyber problem

A cyber incident can expose weaknesses far outside the security team. What failed technically may be different from what allowed the impact to become significant.

A diagram of six connected areas of technology readiness: Business & Technology Alignment, Technology Environment & Modernization, AI & Intelligent Automation, Cybersecurity & Resilience, IT Operations & Operating Model, Governance, Investment & Execution. They reinforce one another when they move together, and create friction when they do not. Alignment Modernization AI Cybersecurity Operations Governance Technology readiness

Where this guidance comes from

These are public references, not a claim that Mickom conforms to, is certified by, or is endorsed by any of them.

Not sure whether this is really a cybersecurity problem?

Security issues often intersect with technology ownership, modernization, resilience, investment decisions, and business priorities. If there is a question leadership needs to work through, tell me where the uncertainty sits.

For a directional view across all six areas, the Executive Technology Readiness Assessment takes about ten minutes.

Tell me where the uncertainty sits