Pillar 3 · Cybersecurity & Compliance
Incident Response, Threat Detection, and Cyber Resilience
Updated 2026-10-24 · SYS CRED · Prince George, BC
Direct answer
Incidents need a written plan: detect, contain, eradicate, recover, and review. Tested backups and communication templates turn a crisis into a managed event and protect the website that generates revenue.
Write the playbook before you need it
Document who to call, how to isolate systems, and how to preserve logs. Ransomware decisions without forensics and backups are a gamble.
Include the website and DNS. Defacements and SEO spam injections count as incidents.
- 24/7 contact tree
- Offline copy of the plan
- Restore drills twice a year
Detection and monitoring SMBs can run
Endpoint protection, MFA alerts, mailbox audit logs, and uptime monitors catch many real attacks. Fancy SOCs are optional; ignored alerts are not.
Define severity levels. Not every phishing email should page the owner at 2 a.m., but critical auth failures should.
Continuity for digital revenue
Know your RTO and RPO for the site, CRM, and email. A redesign without a backup strategy is one outage away from going quiet.
After recovery, file Security issues in Search Console if the site was used for spam, and force password resets for admin users.
Frequently asked questions
Should we pay ransomware?+–
Get legal and incident-response advice. Prevention and restores are a better strategy than payment.
Is cyber insurance enough?+–
Insurance helps financially. It does not replace detection and backups.
How fast should we disclose?+–
Follow legal obligations and customer contracts. Keep counsel available.