magine coming to work on a Monday morning with a full slate of patients awaiting care, yet none of your computer systems work and all your files are encrypted. Sadly, this is becoming a common occurrence among even the most cyber-cautious veterinary clinics.

The pervasive misperception that some businesses are too small or do the kind of work that won’t attract cybercrime continues to stun vet clinics when they fall victim to a cyberattack. The value of the average clinic’s digital assets—from the doctor’s personal finances to its client contact and payment information—is often too tempting for cybercriminals to ignore.

When cybercriminals find their way into your systems, it becomes difficult (if not impossible) to offer the same level of care for patients while trying to mitigate the fallout of a cyber incident. Whether ransomware, social engineering or breaching of one of your vendors, the schemes deployed by today’s digital thieves have far-reaching impact for clinic owners, staff, vendors and clients.

Thankfully, most cyber incidents can be resolved with the help of professional cyber incident response teams. How difficult or lengthy that resolution becomes depends largely on a clinic’s preparation and the quality of the contingency plan that’s prepared in advance.

Let’s review some of common cyber incidence response tactics and the steps for planning ahead that make them easier to deploy following a cyber intrusion.

1. Vet Your Vendors and Set Up External Connection Permissions.

Recovery Instructions: As soon as they are notified of a cyberattack, an incident response team typically will launch a forensic investigation to identify the criminal’s point of entry. As mentioned above, third-party vendors pose a high penetration risk to vet clinics. IT-managed services can be particularly popular targets for cybercriminals because they hold the keys to the digital kingdoms of many individual clients. Breaking into a single-managed services provider may give threat actors access to hundreds of external systems, all for the effort of one.

The Plan-Ahead Prescription: Understand which third-party providers have access to your systems and ask how they secure those connections. Insist on connection requests being a regular part of your engagement. No one should be able to log into your local network without an authorized staff member pressing a button to let them in every single time.

2. Prepare a Cyberattack Contingency Plan.

Recovery Instructions: When ransomware is in play, your clinic may be contacted by the threat actor directly. They will ask for payment in return for unlocking systems they’ve locked or not exposing the data they’ve stolen on the dark web. You may want to ask your incident response team to step in, communicating with the threat actors on your behalf. Specialized expertise, experience in negotiating with ransomware threat actors and sometimes even specific knowledge of the actor or actors behind the attack equips these professionals for such negotiations.

The Plan-Ahead Prescription: Designate a single point of contact (with a backup, should that person be unavailable) who has the authority to pay or decline a demand for ransom. Formalize this authority by including the individuals’ names or positions in a written cyberattack contingency plan. Be sure to keep a hard copy in the office, as digital-only plans could be locked down during a cyberattack. Train staff regularly on the policies and procedures outlined in the contingency plan. If possible, perform an annual tabletop exercise on your plan.