What Matters Most in the First Few Hours After a Ransomware Attack? The Integration of ISMS, BIA, and BCM

The first few hours following a ransomware attack often reveal how well an organization is prepared for an actual outage. This isn’t just a matter of the level of technical security. What matters most is whether the organization knows which services it must restore first, what its operations depend on, and who is responsible for making decisions in a crisis.

This is precisely where the importance of integrating information security management (ISMS), business impact analysis (BIA), and business continuity management (BCM) becomes apparent. These are three areas that organizations often address separately, but which must work together in the event of an actual incident.

The First Few Hours After a Ransomware Attack: When Standard Procedures Stop Working

Organizations that have been hit by a ransomware attack describe the first few hours in very similar terms. To prevent the attack from spreading further, parts of the network must be taken offline. Services come to a halt; email stops working, and often the phone system goes down as well.

Suddenly, normal communication and work processes are unavailable. People cannot access the information they normally use, and individual teams must begin working on restoring operations.

At that point, the main question is no longer whether the organization has conducted a risk analysis or how good its firewall is. Much more specific questions come to the forefront:

• Which services do we need to restore first?
• From which backups can we restore them?
• How long will the restoration take?
• Who decides on the priorities and next steps?
• How will the individual teams communicate if neither email nor the phone is working?

The answers to these questions should not be determined only after an attack occurs. An organization needs to know them in advance, base them on up-to-date information, and regularly verify that the prepared procedures actually work.

Technical and safety documentation are often developed separately

Organizations invest in various areas of cybersecurity. They purchase firewalls, backup systems, endpoint protection, and monitoring solutions. This is often a response to a specific problem—a security incident, an operational outage, or findings from a penetration test. In addition, security documentation is created. This includes risk analyses, security policies, asset inventories, and other materials that organizations need for audits, compliance with legislative requirements, or internal security management.

There is nothing wrong with this approach. Technical measures and security documentation are essential. The problem arises when these areas are not integrated. An organization may have a high-quality backup system, but it may not know which systems to restore first. It may have a detailed risk analysis, but without an understanding of how the outage of a specific service will impact its operations.

Similarly, an organization may have a contingency plan in place that does not, however, reflect the current state of its information systems. In the event of an actual incident, the various technologies and documents then fail to provide a comprehensive basis for decision-making.

ISMS, BIA, and BCM: Three Layers That Must Work Together

For an organization to respond effectively to a ransomware attack or other serious outage, it needs to integrate three key areas.

1. ISMS: What Do We Have, What Do We Depend On, and What Threatens Us?

ISMS (Information Security Management System) is a system for managing information security.

One of its key components is an up-to-date overview of assets, their interrelationships, and the associated risks.

For example, an organization may discover that a key business process depends on a single server or a single external technical support provider.

Such information is essential not only for risk assessment but also for planning the resumption of operations.

ISMS helps answer the question: What do we have, how are the individual components related to one another, and what threats do they face?

2. BIA: How long can we afford to be down?

BIA (Business Impact Analysis), which is an analysis of the impact on an organization's operations, builds on an understanding of assets and their interrelationships.

Its task is to determine what the consequences of an interruption in individual services would be and how long the organization can continue to operate without those services.

The most important parameters are, in particular:

• RTO (Recovery Time Objective) – the target time by which a service should be restored after an outage.
• RPO (Recovery Point Objective) – the maximum acceptable data loss expressed as a time interval.

For example, if an organization sets an RTO of four hours for a particular service, but restoring it from a backup takes two days, there is a fundamental mismatch between operational requirements and actual IT capabilities.

It is BIA that helps identify such differences early on. At the same time, it provides the basis for decisions regarding investments in backup, redundancy, and other measures. This allows an organization to better distinguish where it needs a higher level of availability and where, conversely, it might be investing in technologies that do not meet its actual operational needs.

BIA answers the question: How long can we go without a specific service, and how much data loss can we afford?

3. BCM: What exactly will we do if an outage occurs?

BCM (Business Continuity Management) focuses on managing the continuity of an organization's operations.

Based on an understanding of assets, their interdependencies, and the impacts of outages, specific procedures for managing emergency situations are developed.

This includes contingency plans that specify:

• What steps need to be taken.
• Who is responsible for each activity?
• Who decides on the next steps?
• What contacts and communication channels will be used?
• What alternative procedures can be used when standard systems are unavailable?

It is important that contingency plans remain accessible even when the regular IT infrastructure is down.

It is equally important to test them regularly. After all, a plan that no one has tested may not align with the organization’s capabilities in a real-world situation.

BCM answers the question: How will we proceed, who will do what, and how will we ensure the continuation or resumption of key operations?

Why is the integration of ISMS, BIA, and BCM so important?

Each of these areas offers a different perspective. However, their true value becomes apparent only when they build on one another and are based on the same, up-to-date information.

In practice, problems with managing them separately manifest themselves in several ways.

The contingency plan does not reflect the current state of the IT infrastructure.

If a business continuity plan is not based on an up-to-date map of assets and their interdependencies, it can become outdated as soon as the first major change to the infrastructure occurs. The system, vendor, or method of service delivery may change, but the crisis response procedure remains the same.

The restoration requirements do not match the actual capabilities.

BIA sets the RTO at four hours, while actual recovery from a backup takes two days. If an organization does not verify this discrepancy, it will not discover it until the moment it actually needs to restore the service.

The risk analysis does not take operational impacts into account.

A risk analysis can determine the likelihood and severity of security threats. However, without being linked to a BIA, it may not adequately identify which services are truly critical to the organization’s business continuity.

Technology investments do not align with the organization's priorities.

If security technologies are implemented without an understanding of operational dependencies and the impact of outages, they may primarily protect what is most visible.

However, they may not provide sufficient protection for the systems and services on which the organization actually depends the most.

A common problem in all these situations is a lack of information integration. Although the organization has the technology, documentation, and crisis procedures in place, the individual components are not based on a common foundation.

How We Integrate ISMS, BIA, and BCM in Open Apps Development

At Open Apps Development, we develop tools with the goal of connecting all three areas so that they work with the same data and the individual pieces of information flow naturally from one to the next.

OMIS: A Common Framework for Asset and Risk Management

OMIS (Open Management for Information Security) is used to manage information security and handle information about assets, their interrelationships, and risks.

It thus creates a data foundation that can serve as the basis for other processes related to security and business continuity.

OBIR: Impact Analysis and Restoration Requirements

The information maintained in OMIS is followed up by OBIR, which focuses on BIA and the determination of RTO and RPO parameters.

It thus helps link knowledge of assets and their dependencies to specific requirements for service availability and recovery.

BCM: Contingency Plans Based on Current Information

In collaboration with PERITRA, a company with expertise in crisis management and the development of crisis response procedures, we are developing a BCM system for creating, managing, and testing crisis plans.

The goal is to ensure that crisis procedures are not developed in isolation, but are based on up-to-date information about assets, their interdependencies, and the impacts of potential outages.

In this way, the organization can gradually link its understanding of its environment, recovery requirements, and the specific actions that need to be taken during an emergency.

Ransomware preparedness doesn't begin only when an attack occurs

A ransomware attack very quickly tests whether an organization can translate information about its systems and risks into concrete decisions and actions.

Security technologies alone are not enough. Similarly, documentation is not enough if it does not reflect current operations and is not linked to actual recovery options.

ISMS provides an overview of assets, dependencies, and risks. BIA identifies the impacts of outages and recovery requirements. BCM translates this information into specific procedures and responsibilities.

When all three areas work with shared data, the organization has a better basis for decision-making, can identify discrepancies between requirements and actual capabilities in a timely manner, and can develop contingency plans that reflect the real-world environment.

And that's exactly what we're all about at Open Apps Development .

We want to ensure that organizations don't have to improvise in the event of an outage.

‍