COI Report – Part VII
Page
314 of
425 41.1.1 Testing of incident response plans is critical 914. Testing is critical because it provides an opportunity to reveal weaknesses and omissions that ought not to be discovered only after a breach already has occurred. Planning can only go so far, and while organisations can strive to create comprehensive incident response plans, failure to test such
plans until areal event occurs, may result in the realisation (too late) that the plans fail at the first step because they are unworkable, or did not adequately consider real-world constraints or difficulties. The failure to frequently test an incident response plan could result in increased response time, confusion amongst the responders, and at its worst, a failure to even respond to a serious security incident.
915.
Organisations, in particular IHiS, must ensure that training and building familiarity with incident response plans is ongoing. Training should be continuous and not limited to a onetime event. Continuous mechanisms must be in place for ensuring that reporting triggers and reporting procedures are known, understood, and complied with. This should be led by CEO, IHiS.
At the same time, SingHealth and MOHH are to have oversight of this, as the system owner and the holding company respectively.
916. All relevant parties should be drilled on the response plan, with exercises and simulations carried out regularly. The creation of an incident response plan must not be viewed as a onetime exercise. It is an ongoing process, and refinements to the plan must be made when drills demonstrate the need for the plans to be modified. Ensuring that plans are reviewed and amended on an ongoing basis will allow incorrect information regarding tools and people to be updated, and for reviewing of response
measures that do notwork, or are out of order. This is consistent with Vivek’s expert testimony that “
a plan that is a Word document that is filed somewhere, or a PDF that is filed somewhere does not help” and that the plan should be kept current and effective by constantly updating it after every incident and after every TTX. For example, simulation exercises can prevent confusion by engaging with all the key stakeholders
to set clear expectations, contributing to the completeness and clarity of post-breach actions and responsibilities. Gen. Alexander’s evidence was explicit that,
