---
title: CIR BC Strategies for Processes
description: CIR BC Strategies for Process
image: https://blog.bcm-institute.org/hubfs/Manager%20Guide%20to%20BCM%20for%20Cyber%20Security%20Incidents/C7%20Chapter%207%20Developing%20Mitigation%20and%20Response%20Strategies/C7%20Morepost/IC_CIR_BC%20Strategies_Process.png
---
[](http://www.bcm-institute.org/)
- [Home](https://www.bcm-institute.org/)
- [About Us](https://www.bcm-institute.org/about-us-3/)
- [A President’s Perspective](https://www.bcm-institute.org/about-us/a-presidents-perspective/)
- [Our History](https://www.bcm-institute.org/about-us/our-history/)
- [Our Advisory Council](https://www.bcm-institute.org/about-us/our-advisory-council/)
- [Customers’ Testimonials](https://www.bcm-institute.org/about-us/customers-testimonials/)
- [Credential Verification](https://www.bcm-institute.org/about-us/credential-verification/)
- [Courses](https://blog.bcm-institute.org/blog/course-fees-for-blended-learning-courses-master-catalog)
- [ISO 22301 Business Continuity Management System Audit](https://blog.bcm-institute.org/audit/business-continuity-management-audit-courses)
- [ISO 22301 Business Continuity Management](https://blog.bcm-institute.org/bcm/business-continuity-management-courses)
- [Crisis Communication](https://blog.bcm-institute.org/crisis-communication/crisis-communication-courses)
- [Crisis Management](https://blog.bcm-institute.org/en/crisis-management/courses)
- [IT Disaster Recovery](https://blog.bcm-institute.org/it-disaster-recovery/courses)
- [Operational Resilience](https://blog.bcm-institute.org/operational-resilience/courses)
- [Operational Resilience Audit](https://blog.bcm-institute.org/operational-resilience-audit/courses)
- [Certification](https://blog.bcm-institute.org/certification/types-of-certifications-offered)
- [ISO 22301 BCMS Audit Certification](https://blog.bcm-institute.org/certification/business-continuity-management-audit-certification)
- [ISO22301 Business Continuity Management Certification](https://blog.bcm-institute.org/bcm/business-continuity-management-certification)
- [Crisis Communication Certification](https://blog.bcm-institute.org/crisis-communication/crisis-communication-certification)
- [Crisis Management Certification](https://blog.bcm-institute.org/en/crisis-management/crisis-management-certification)
- [IT Disaster Recovery Planning Certification](https://blog.bcm-institute.org/it-disaster-recovery/it-disaster-recovery-certification)
- [Operational Resilience Certification](https://blog.bcm-institute.org/operational-resilience/operational-resilience-certification)
- [Operational Resilience Audit Certification](https://blog.bcm-institute.org/operational-resilience-audit)
- [Seminars](https://blog.bcm-institute.org/meet-the-expert/mte-webinar-mainpage)
- [Store](https://www.bcm-institute.org/store-2/)
- [Contact Us](http://www.bcm-institute.org/about-us/contact-us/)
-
-
##### Cybersecurity Series
# CIR BC Strategies for Processes
This article discusses the preventive, mitigation and recovery strategies for protecting the Processes.
Encryption. Encryption refers to the conversion of sensitive organizational information into complex codes that is unreadable by humans using algorithms, increasing the difficulty encountered by cyber criminals to gain access to the information.
Continuous Improvement. As technology develops, the techniques deployed by cyber criminals become more complex. Organizations must continuously adapt and improve the processes of utilising their information assets so that disruptions to CBFs are avoided or reduced.
Penetration Testing/ Simulation Exercises. Mapping out cyber criminals' attack vectors allows organizations to identify which areas require strengthening security controls. The effectiveness of the implemented security controls is evaluated to determine if they can mitigate potential cyber security attacks.
Reference: Chapter 7 Developing Mitigation and Response Strategies 7.21 Process
[Moh Heng Goh](https://blog.bcm-institute.org/cyber-security/author/moh-heng-goh) Nov 20, 2022
### CIR BC Strategies for Processes
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/e6bfa96a-1a62-4396-b9bf-892b42f4e7be)This article discusses the preventive, mitigation and recovery strategies for protecting the Processes. These strategies are:
1. Encryption
2. Continuous Improvement
3. Penetration Testing/ Simulation Exercises
#### 1. Processes: Encryption
Encryption refers to the conversion of sensitive organizational information into complex codes (NCI, 2015) that is unreadable by humans using algorithms, increasing the difficulty encountered by cyber criminals to gain access to the information.
Only possession of the correct ‘key’ can decrypt the information into its original form. Sensitive information in IT infrastructures or transferred via the network should be encrypted (Florida Tech, 2017) as these platforms are common targets of cyber criminals.
The ‘key’ can be kept protected with multi-factor authentication procedures.
#### 2. Processes: Continuous Improvement
There is no one-way solution in dealing with cyber security incidents. Every organization utilizing information assets is susceptible to cyber security attacks. The differentiating factor between organizations is how impacts associated with the respective cyber security threats are mitigated or minimized. As technology develops, the techniques deployed by cyber criminals become more complex. Organizations must continuously adapt and improve the processes of utilising their information assets so that disruptions to CBFs are avoided or reduced.
See ***Appendix 21*** for more details on the different methodologies for continuous improvement. \[Under construction\]
#### 3. Processes: Penetration Testing/ Simulation Exercises
For organizations to install effective countermeasures against cyber security attacks, putting themselves in the role of a cybercriminal allows them to understand the mindset and outline the paths that cyber criminals can utilize to attack their organizations.
Mapping out cyber criminals' attack vectors (Shortridge, 2017) also allows organizations to identify which areas require strengthening security controls. The effectiveness of the implemented security controls is evaluated to determine if they can mitigate potential cyber security attacks.
Simultaneously, the attack pattern of cyber criminals may be disrupted with corrective actions implemented after tests or exercises, halting their learning curve and ability to profile the organizations, making their cyber security attack less likely to succeed.
#### Component of PrEvention/ Mitigation CIR BC Strategies
| **BACK TO: Mitigation and Response Strategies ** | **CIR BC Strategies for Infrastructure** | **CIR BC Strategies for People** | **CIR BC Strategies for Policy** |
| --- | --- | --- | --- |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/4b5292f4-50c4-4d39-bf9d-ef6b8a23fc4e) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/bd1e5a1d-1fe4-4057-8341-e230720818a5) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/10f87e93-bd46-4025-bb32-598fc364bfba) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/fddee515-f91f-48c3-a49d-1a507d3997a4) |
| **CIR BC Strategies for Process** | **CIR BC Strategies: Respond** | **CIR BC Strategies: Recover** | **CIR BC Strategies: Defence Lines** |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/e6bfa96a-1a62-4396-b9bf-892b42f4e7be) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/184ed63a-2272-42ff-833c-68fb11582434) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/3009cfc9-b3e3-496e-befa-6d1ead99fa7c) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/853bb0d7-21a0-41b8-9b51-a5d8bdb58573) |
#### Do You Want to Continue BCM Training onsite or online?
| **Competency-based Course** | **Certification Course** | | |
| --- | --- | --- | --- |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/685c93a7-08d2-4175-bee7-71781494334e) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/95fc21bd-88bf-43d8-9464-5b00190d76e0) | [![\[BL-3-Catalog\] What Specialist Level Blended Learning Courses that are Available?](https://no-cache.hubspot.com/cta/default/3893111/4b22a53c-6e3e-4b9e-8c2a-888423f1d26c.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/4b22a53c-6e3e-4b9e-8c2a-888423f1d26c) | [![\[BL-5-Catalog\] What Expert Level Blended Learning Courses that are Available?](https://no-cache.hubspot.com/cta/default/3893111/fe175db3-7f57-4636-bf09-e9a836aa5478.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/fe175db3-7f57-4636-bf09-e9a836aa5478) |
#### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/2a55f179-a251-4490-bd1c-856467aea198)
Goh, M. H. (2017). A Manager's Guide to Business Continuity Management for Cyber Security Incidents, 2nd Edition. GMH Pte Ltd.
Reference: Chapter 7 Developing Mitigation and Response Strategies 7.21 Processes
Note: This version was the draft 2nd Edition being updated in 2023. The numeric in the square bracket \[X-X\] cross-refers to the actual chapter and section in the 1st Edition.
**Comments:**
### More Posts
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/04334171-099a-49e5-becc-c8c082c7947f)
All rights reserved. Copyright 2026
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Moh Heng Goh",
"url" : "https://blog.bcm-institute.org/cyber-security/author/moh-heng-goh"
},
"dateModified" : "2022-11-23T05:51:49.796Z",
"datePublished" : "2022-11-20T13:57:17.000Z",
"headline" : "CIR BC Strategies for Processes",
"mainEntityOfPage" : {
"@id" : "https://blog.bcm-institute.org/cyber-security/cir-bc-strategies-for-process",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.bcm-institute.org/hubfs/BCMI%20Logo.png"
},
"name" : "BCMI Pte Ltd"
}
}
```