What actions are we considering?
Change management with staged rollouts is the strongest option: €938k net over 3 years
4 of 4 options pay for themselves on their own. Net value is the loss each avoids, minus its cost, plus any other value.
Cost against risk reductionover 3 years · bubble size: how uncertain · label: expected return (RoSI)
What each intervention changesintervention → part of a scenario → scenario · click one to edit it
Interventions4 of 4 included
Immutable backups with tested restores
Offline, immutable copies of ERP and warehouse data, and a restore of the core systems rehearsed twice a year.
| Category | Measure |
| Implementation cost | €40,000 / €60,000 / €90,000 |
| Operating cost / year | €25,000 / €30,000 / €40,000 Backup storage and licences, plus staff time for two restore tests a year. |
| Effect confidence | Pretty sure |
| Changes | Parameter | To | |
|---|---|---|---|
| Ransomware halts operations | Primary cost — typicalRestoring from clean backups instead of rebuilding or negotiating cuts the outage roughly in half. | 60% | |
| Ransomware halts operations | Primary cost — severeRestoring from clean backups instead of rebuilding or negotiating cuts the outage roughly in half. | 40% | |
| Ransomware halts operations | Secondary cost — severeRestoring from clean backups instead of rebuilding or negotiating cuts the outage roughly in half. | 75% | |
| Ransomware halts operations | Duration — typicalRestoring from clean backups instead of rebuilding or negotiating cuts the outage roughly in half. | 50% | |
| Ransomware halts operations | Duration — severeRestoring from clean backups instead of rebuilding or negotiating cuts the outage roughly in half. | 35% | |
| Failed IT change or update takes core systems down | Primary cost — typicalA tested restore is a fallback when a change can't simply be rolled back. | 90% | |
| Failed IT change or update takes core systems down | Primary cost — severeA tested restore is a fallback when a change can't simply be rolled back. | 75% | |
| Failed IT change or update takes core systems down | Duration — typicalA tested restore is a fallback when a change can't simply be rolled back. | 80% | |
| Failed IT change or update takes core systems down | Duration — severeA tested restore is a fallback when a change can't simply be rolled back. | 60% |
24/7 managed detection and response (MDR)
An external security operations centre watching endpoints and servers around the clock, able to isolate machines before ransomware spreads.
| Category | Measure |
| Implementation cost | €20,000 / €30,000 / €50,000 |
| Operating cost / year | €90,000 / €110,000 / €130,000 Per-endpoint subscription for about 800 endpoints and 60 servers. |
| Effect confidence | Somewhat sure |
| Changes | Parameter | To | |
|---|---|---|---|
| Ransomware halts operations | Rate of occurrenceMost attacks are stopped before encryption; those that get through hit fewer systems. | 60% | |
| Ransomware halts operations | Primary cost — typicalMost attacks are stopped before encryption; those that get through hit fewer systems. | 90% | |
| Ransomware halts operations | Primary cost — severeMost attacks are stopped before encryption; those that get through hit fewer systems. | 75% | |
| Ransomware halts operations | Secondary loss probabilityMost attacks are stopped before encryption; those that get through hit fewer systems. | 80% |
Third-party risk management and supplier continuity plans
Security and continuity requirements for critical suppliers, a yearly review of the top 15, and an alternative source or workaround agreed for each.
| Category | Measure |
| Implementation cost | €30,000 / €50,000 / €80,000 |
| Operating cost / year | €40,000 / €60,000 / €80,000 Half a full-time role plus an assessment platform. |
| Effect confidence | Unsure |
| Changes | Parameter | To | |
|---|---|---|---|
| Critical supplier knocked out by a cyberattack | Rate of occurrenceLittle change in how often suppliers are hit; switching to an agreed alternative shortens the outage. | 90% | |
| Critical supplier knocked out by a cyberattack | Primary cost — typicalLittle change in how often suppliers are hit; switching to an agreed alternative shortens the outage. | 75% | |
| Critical supplier knocked out by a cyberattack | Primary cost — severeLittle change in how often suppliers are hit; switching to an agreed alternative shortens the outage. | 60% | |
| Critical supplier knocked out by a cyberattack | Secondary cost — typicalLittle change in how often suppliers are hit; switching to an agreed alternative shortens the outage. | 80% | |
| Critical supplier knocked out by a cyberattack | Secondary cost — severeLittle change in how often suppliers are hit; switching to an agreed alternative shortens the outage. | 70% | |
| Critical supplier knocked out by a cyberattack | Duration — typicalLittle change in how often suppliers are hit; switching to an agreed alternative shortens the outage. | 75% | |
| Critical supplier knocked out by a cyberattack | Duration — severeLittle change in how often suppliers are hit; switching to an agreed alternative shortens the outage. | 60% |
Change management with staged rollouts
Changes and vendor updates go to a test group first and then out in waves, with a rollback plan for every change to a core system.
| Category | Measure |
| Implementation cost | €15,000 / €25,000 / €40,000 |
| Operating cost / year | €20,000 / €30,000 / €45,000 Mostly staff time: a change board and a test environment. |
| Effect confidence | Pretty sure |
| Changes | Parameter | To | |
|---|---|---|---|
| Critical supplier knocked out by a cyberattack | Primary cost — severeA supplier's faulty update is staged too, so it can't take everything down at once. | 90% | |
| Failed IT change or update takes core systems down | Rate of occurrenceMost bad changes are caught in the test group; the rest reach only one wave. | 60% | |
| Failed IT change or update takes core systems down | Primary cost — typicalMost bad changes are caught in the test group; the rest reach only one wave. | 90% | |
| Failed IT change or update takes core systems down | Primary cost — severeMost bad changes are caught in the test group; the rest reach only one wave. | 60% | |
| Failed IT change or update takes core systems down | Duration — typicalMost bad changes are caught in the test group; the rest reach only one wave. | 70% | |
| Failed IT change or update takes core systems down | Duration — severeMost bad changes are caught in the test group; the rest reach only one wave. | 50% |