By Angie Newland @ Angels Admin Support
We are all aware of the massive impact that a Cyber Attack can have on a firm, but one area that Isn’t often discussed is the effect that it has on the individuals within a firm that may be directly involved.
HR Review published an article recently about this, which got me thinking about how some of the smaller firms with no HR support would or should be approaching this, and also how firms would support those employees that have been directly involved in a Cyber Attack incident within the firm.
The article called “Parisa Bazl: Addressing the Psychological Impact of Cyber Attacks” Parisa (Head of User Experience at Commvault) raised some interesting points -
- “There is a worrying and often overlooked human element that can have serious personal consequences for those involved, in particular, employees targeted by cybersecurity threat actors and the cybersecurity professionals tasked with mitigating the impact of an attack. In either case, they can suffer from a range of serious and long-lasting harms, which, according to a study from the Royal United Services Institute (RUSI), includes everything from psychological, physical, and financial to reputational and social problems.
- “So, what needs to change to turn this situation around? Key to the whole process is a clear understanding that everyone within modern, digitally centric organisations can potentially be vulnerable to the impact of a security incident. At the heart of this approach is building an organisational culture that actively embraces opportunities for knowledge sharing and the role of strong communication in both preventing attacks and then mitigating their subsequent impact.”
- “Without this positive cultural system in place, organisations run the very real risk that employees simply will not report cybersecurity incidents to management, particularly out of fear of the repercussions they may face. Indeed, research published last year on the problem showed that over 40 percent of cyber-attacks were not disclosed to internal management. Of those people who had failed to report an incident, three-quarters said they felt guilty as a result.”
Looking at just these 3 comments in the article, and thinking about them from an HR and FCA perspective, I can see that there is a need for firms to –
- Encourage employees to report incidents – Making sure that employees are psychologically safe in the workplace
- Support employee’s mental health and wellbeing – Have a Mental Health First Aider or champion within the workplace
- Keep learning and development current and up to date – Have a good Training programme in place for employees
- Build a good workplace culture – Keep employees involved in building a culture within the firm that they want to stay working in
- Risk Assess – Risk Assessments are key to making sure that risks are assessed and accounted for.
- Policies and Procedures - Have these in place so that employees know what to do, and who to report to in the event of a cyber-attack.
Have you really thought about how your employees may be affected in the event of them being directly involved in a cyber-attack against your firm?
Does your firm have a clear policy and process if there is a cyber-security attack, and does it cover support for employees involved?
Do you have a Mental Health First Aider?
How much Training and Development do you currently provide around Cyber Security, and Cyber Attacks?
It certainly gives us lots to think about in relation to how improvements can be made, and the importance of always reviewing the systems and controls that you have in place to accommodate for change. You know what they say – There is always room for improvement!
Here is the link to the article:
If you would like to see how we at Angels Admin Support can assist you with Cyber Security Training and Resources, Culture, EDI, Mental Health, and all the other things mentioned in relation to this blog, then please do get in touch, we would love to hear from you.
Email: angie@angelsadminsupport.co.uk