Cybersecurity Policy

A Business Continuity Team has been established. The chair of this temporary team for a cybersecurity situation will be the Director of Finance. The core team consists of the CEO and all relevant Directors.

The team is likely to require the addition of any or all of the Senior Operations Manager, Communications Manager, IS Manager, and Information Manager, and others who may be drafted in temporarily depending on the nature of the situation. The Chairperson of the Board is also welcome to be part of the team when available and appropriate. 

 As an incident emerges, The Wheel will follow the Business Continuity Management Steps.

1. Assemble the Business Continuity Team (BCT)
2. Ensure the safety and wellbeing of staff
3. Assess the crisis and understand the risks to the organisation, with reference to the Risk Register
4. Develop and implement a risk mitigation strategy, based on the Risk Register for relevant previously identified risks
5. Set up working teams within the executive and at board and sub-group level as required e.g. regular meetings of Senior Management Team, Finance and Audit sub-group, Board etc.
6. Identify a designated person to follow up on agreed actions and to report back to any necessary team/overall BCT with actions/progress and updates.
7. As the crisis is mitigated with actions, comes to a natural conclusion, or is merged into ongoing day-to-day operations, the business continuity team will cease to meet.

Any such cybersecurity incident may require remedies such as a halt to using company hardware and software, turning off the internet to the organisation, or other such response. This may include losing access to the Microsoft suite of products (email, SharePoint, Teams, etc.), Salesforce and company laptops. This action will have a detrimental effect on staff’s ability to perform their duties and will be as short as necessary. However, it is imperative that all staff are aware of the risks as soon as possible and communicated with to ensure the incident is contained and not inadvertently worsened. 

Workaround communication channels include: 

• the staff what’s app group 
• phone calls via mobiles or WhatsApp
• group video calls via WhatsApp 

Staff are likely to be affected by the incident both professionally and personally. The BCT must communicate with them as early and as fully as possible. 

Staff should also be aware that the BCT will be managing external communications and that they should not speak with media or outside parties (see Crisis Communications policy)

In any such attack, the following items should be considered to be the priorities:

1. Sensitive personal details of staff 
2. Sensitive personal details of members
3. Banking access and control over the organisation’s funds
4. Others as decided as appropriate by the BCT

The practice of paying ransoms demanded by attackers will in all circumstances be a matter for the Board to decide upon regardless of the amount required. 

We have a range of professionals who we consult for advice including auditors, legal advisers and other consultants who we can turn to for advice in a crisis. Specifically in the cybersecurity space, as of June 2023 we engage SupportIT on retainer as our IT support, and Annertech on retainer as our main website support. 

The Business Continuity team along with third parties if necessary, will decide whether an incident needs to be reported to the Data Protection Commissioner or other regulatory body. Care must be taken in this regard to adhere to strict time limits (currently 72 hours maximum). 

We must also inform individuals of any breach of our systems, where such a breach is likely to result in a high risk to those affected individuals. (See separate data protection policy)

The Wheel are aware that some cyberattacks such as ransomware are relatively “low-tech” and may have a comparatively simple existing solution (such as a widely available decryption key). We will work with our IT partners in this regard. 

The Wheel have a wide range of experience and expertise in our board and non-board sub-group membership who should be consulted in a crisis situation. 

Many cybersecurity situations will contain a significant element of internal and external communications. Please refer to our Media & Crisis Communications Policy which contains provisions for crisis communications.