Cyberattack preparedness starts before the crisis, not during it. Recent attacks on municipalities and businesses in South Dakota exposed a painful pattern: organizations that survived with minimal downtime had three things in common. They tested their backups monthly, maintained an incident response plan that staff actually knew about, and trained employees to spot phishing attempts. The organizations that lost weeks of productivity and thousands of dollars had none of these.
What does cyberattack preparedness actually require?
Preparedness is not a checklist you complete once. It is a rhythm of testing, training, and documentation that turns a potential catastrophe into a manageable incident.
Your backups are the foundation. But a backup you have never restored is a promise, not a plan. One South Dakota municipality discovered their backup system had silently failed six months earlier. They learned this during a ransomware attack. Schedule quarterly restoration tests of at least one critical system. Time how long it takes. Document every step. Store one copy offline or in immutable storage that ransomware cannot encrypt.
Your incident response plan answers one question: who does what in the first hour? When your receptionist opens a phishing email at 9:00 AM, does she know to unplug her network cable and call a specific person? Does that person know whether to shut down the file server or leave it running for forensics? Write down the decision tree. Include after-hours contact numbers for your IT provider, your insurance carrier, and your attorney. Print it and store copies in multiple locations.
Employee training prevents more attacks than any firewall. Phishing remains the entry point for most breaches. Monthly five-minute training sessions, real simulated phishing tests with immediate feedback, and a culture where reporting a mistake is celebrated (not punished) will close your largest vulnerability.
How much downtime can your business actually survive?
The honest answer determines your investment. A manufacturing plant that loses $10,000 per hour of downtime needs different cyberattack preparedness than a consulting firm that can work offline for a day.
Calculate your true cost. Include lost revenue, idle payroll, customer penalties, and reputational damage. Then compare that number to the cost of daily backups, managed detection and response, and annual tabletop exercises. For most SMBs, the breakeven happens after preventing just one multi-day outage.
Recovery time depends on documentation. Can you rebuild your email server from notes, or does the configuration live only in your IT person’s head? Document your network topology, application dependencies, and vendor credentials in a secure location accessible during an emergency. This single step cut recovery time in half for a South Dakota business after their primary domain controller was encrypted.
Who should own your incident response plan?
Your leadership team, not just IT. The decision to pay a ransom, notify customers, or involve law enforcement is a business decision with legal and financial consequences.
Assign roles before the crisis. Who communicates with customers? Who contacts your cyber insurance carrier (within the policy’s notification window, often 24-48 hours)? Who preserves evidence for potential law enforcement involvement? Who decides when to bring systems back online?
Test the plan annually with a tabletop exercise. Gather your response team, present a realistic scenario (ransomware detected on the accounting system at 6:00 PM on a Friday), and walk through your response step by step. You will discover gaps in authority, missing contact information, and assumptions that do not match reality. Fix them before the real event.
If you lack in-house IT leadership, your managed service provider should facilitate this exercise and maintain the documentation. The plan lives or dies based on whether people can find it and execute it under stress.
What role does cyber insurance play in preparedness?
Insurance transfers financial risk but does not prevent downtime. Policies typically cover ransom payments, forensics, legal fees, and customer notification. They do not cover lost revenue during downtime (unless you purchase business interruption coverage, which is expensive and limited).
Most carriers now require minimum security controls before they will quote coverage: multi-factor authentication on all remote access, endpoint detection and response on all devices, tested backups, and security awareness training. These requirements exist because insurers have data showing they work.
Read your policy’s incident notification requirements. Missing a 24-hour reporting window can void coverage. Keep your broker’s emergency contact information in your incident response plan.
How do you prioritize limited security budgets?
Start with the controls that prevent the most common attacks. Multi-factor authentication stops 99% of automated credential attacks. Application patching within 30 days closes known vulnerabilities before widespread exploitation. Email filtering with link protection catches most phishing attempts.
Then invest in detection and response. You cannot prevent every attack, but you can detect and contain most within hours instead of months. Managed detection and response services provide 24/7 monitoring, threat hunting, and incident response for a fraction of the cost of hiring those capabilities internally.
Finally, plan for recovery. Immutable backups, tested restoration procedures, and documented systems enable you to recover without paying ransoms or losing weeks of data.
Professional services firms and manufacturers face different threat profiles but share common needs. Both rely on customer trust, regulatory compliance, and operational continuity. A breach that exposes client data or halts production for a week can end contracts and damage reputations that took years to build. Cyberattack preparedness is not an IT project. It is a business continuity requirement.
The South Dakota attacks reminded small and mid-sized businesses of a truth that larger enterprises learned years ago: recovery speed depends on preparation depth. Organizations that treat cybersecurity as a continuous practice, not a one-time purchase, experience shorter downtimes, lower costs, and faster returns to normal operations when attacks occur.
Keep reading
- cybersecurity breach response planning
- business continuity and downtime prevention
- professional services firms
Sources
Source: Lessons learned from recent South Dakota cyberattacks
Researched and drafted with AI. Published before TC3 added human review in October 2026; questions go to a human at [email protected].