How to prepare for a cybersecurity incident

Take action

Create a Cybersecurity incident response plan

The Royal Australian College of General Practitioners (RACGP) recommends that all practices develop a cybersecurity incident response plan. A representative from the practice should be nominated to maintain and update the plan, with multiple staff trained on how to use the plan and where it is stored. It is recommended that an offline copy of the plan be kept, either as a printed copy or on an air-gapped device.

The plan should cover:

• Clear criteria for when the cybersecurity response plan should be activated
• The key roles and responsibilities of team members when the plan is activated, including backup contacts in case key individuals are unavailable
• Details on how to isolate the systems impacted to limit damage and guidance on how to secure unaffected systems
• Details of the systems, devices and data covered by the plan and critical services that must be prioritised for restoration
• The communications channels to be used for sharing information internally and externally during an incident, including pre-prepared template messages to ensure accuracy
• The steps required to restore services and verify their safety, ensuring critical clinical and business functions are operational before resuming normal use. This includes documenting what has been restored and when
• Follow up actions to investigate the incident to establish how it happened and inform a prevention strategy
• Details on how the plan is tested