Page 1Information Assurance and Risk ManagementWhite PaperA Critical Analysis ReportIn this white paper the author draws attention of the executive to the personal and organisationalrisks they face, how information assurance and risk management best practices can guard againstever-increasing cyber security threats, and how Cerious Cybernetics Corp can create opportunitieswith customers and suppliers who value independent reassurance.Page 2ContentsIntroduction ..3Executive Summary 4News Headlines 5Challenges for CCC .5Using Standards ..6Selecting Standards 7Implementing Standards Frameworks .8Risk Management ..9Assessing Risk 10Current Risks, Vulnerabilities, Threats, and Hazards 10Risk Management in Action An Example 11Assurance and Certification ..11Organisational Structure Considerations .12Ransomware and Service Improvement Plan (SIP) .12Future Risk and Assurance Challenges ..15Summary ..15Acronyms and Abbreviations .16References ..16Resources .21Appendix A Assumptions .22Appendix B Legislation, Regulation, Contractual .23Appendix C Policies .27Appendix D Assets 33Appendix E Statement of Applicability .34Appendix F Supporting Standards 41Appendix G ISO27k_ISMS_implementation_and_certification_process_v4.pdf 44Appendix H Common Threats and Hazards 45Appendix I Mapping ISO to NIST ..48Appendix J Future Risks 49Appendix K Organisational Structure .53Page 3IntroductionCerious Cybernetics Corp. (CCC) is a private cybernetics research and development company thatrequire fit-for-purpose, robust and comprehensive information assurance and risk managementpolicies, procedures and practices which will ensure successful information assurance for theirbusiness via cutting edge and relevant risk assessment, treatment and management both in thecurrent climate and also, for future provision.CCC is competing in the research and development market space which according to Gould andBender (2015) has increased in value from USD $63.5BN in 2015 to USD $71.8BN in 2017 accordingto the DoD (2016), and in the UK around half of the £410 million Ministry of Defence (MOD) scienceand technology (S&T) research is outsourced to the commercial market by the Defence Science andTechnology Laboratory (DSTL) and this is will be increasingly outsourced advises the DSTL(2014/2016).Cerious Cybernetics Corp. has its headquarters in London, England, employing a total of 60 full timestaff and at any given time upwards of 20 agency staff. The headquarters is the location for the corebusiness functions such as Human Resources, Finance, IT, data governance, legal resources andservice level agreements (including those for customers and with the agencies supplying staff). CCCcurrently have a number of ongoing research and development contracts, including the UK Ministryof Defence and the United States Department of Defence.Following extensive critical analysis and research of their expected operational needs at present andover the next five years, they have requested a white paper to act as detailed and critical guide thatwill inform the Cerious Cybernetics Corp. executive about information assurance (from a combined,managerial, organisational and technical perspective) and risk management (from an organisationalcontext). The white paper will aid Cerious Cybernetics Corp.s understanding and ultimately, abilityto make a decision on which policies, procedures need developing and implementing within theorganisation and also ensure any associated resource implications can be successfully supported.The Cerious Cybernetics Corp. executive has further requested a sample Service Improvement Plan(SIP) within the white paper as part of the wider review; specifically, they want the detailedexplanation to focus on the scenario of ransomware. Cerious Cybernetics Corp. is keen to establishimprovements or initiatives which will ensure their IT function including infrastructure and data iskept secure.Page 4Executive SummaryThe executive of Cerious Cybernetics Corp (CCC) can be held personal liable for failings of theirfiduciary duties (Companies Act 2006, Chapter 2 General Duties of Directors). Through a misfeasanceclaim directors can be held personally liable for the diminished value of company assets, such as theloss of Intellectual Property, or for the failure of the company (The Insolvency Service 2011). Bothare possible outcomes from a serious data breach or a loss of critical systems, which could seecustomers lose confidence in the company and the value of assets reduced.It is expedient that directors and company officers fund and direct measures to secure information,and manage risks, thereby demonstrating reasonable care, skill, and diligence.Calder (2009) explains there are four main reasons CCC need to implement Information Assurance(IA) and Risk Management (RM)Strategic requirements within contracts and rules governing the nature of businessrelationships imposed by the government and a decision by the board to better manageinformation security for the businessCustomer and Supplier confidence by demonstrating to customers and suppliers throughthe use of independent assurance and certification, that the company has adopted andimplemented information security best practice, CCC can gain a competitive advantage inthe market. According to MacLennan (2014) assurance implies confidence that theorganisation has done the right thingRegulatory to meet statutory and regulatory requirements which are common to allbusiness and also specifically within this market sectorInternal effectiveness to make the organisation more efficient and effective whenmanaging information and to the risk and impact to the business of any event or data lossBy providing the right level of assurance CCC can secure new opportunities in a growing market(Gould and Bender 2015, DSTL 2014/2016). Without suitable levels of assurance new opportunitieswill be difficult to secure, market share for CCC will reduce, and organisation efficiency will not berealised. CCCs customers and suppliers prefer to trade with companies who can demonstrate IA andRM as it is to their benefit too.The following white paper offers to inform the executive of responsibilities defined within law,applicable regulations and contractual obligations, the challenges and considerations theorganisation faces today and into the future, the concepts and methods for implementing IA andRM. Using a Ransomware case study is used as an example to demonstrate how IA and RM can servethe needs of the organisation and its stakeholders.Page 5News HeadlinesHow would the Board of Cerious Cybernetic Corp. like the news headlines to read?Challenges for CCCCCC must comply with contractual obligations, laws, and regulations in the two principal countrieswhere it operates, the UK where it maintains its headquarters and develops for the Ministry ofDefence (MoD), and the USA where is develops under contract to the Department of Defense (DoD).As a business CCC must comply with regular business law and practices. Additionally CCC operates inthe military research and development (R&D) arena which brings about an additional level ofgovernance, regulation and contractual obligations that are itemised in Appendix B Legislation,Regulation, Contractual.The key asset for the business is the Intellectual Property (IP). Given that this IP is military in naturethe information governance standards imposed are extremely rigorous. Not only does CCC handletheir own IP but they are entrusted with IP from other organisations. Complying with the standardsimposed and being able to demonstrate that CCC can be entrusted with sensitive information iscritical to the success of the organisation.The executive will want to achieve the information security goals of Confidentiality, Integrity,Availability, Authenticity, and Non-Repudiation so that CCC can lower risks, operate efficiently, sellmore, and service customer requirements. Cerious Cybernetics Corp hit byransomware attack and cannotrecover critical data systems!Cerious Cybernetics Corphacked and IntellectualProperty Stolen!CeriousCybernetics CorpLoses CoreCustomersCerious Cybernetics Corp winaward for fastest growingcompany in its sector, directorattributes business growth toinformation assuranceCerious CyberneticsCorp win lucrativenew productdevelopment contractCerious Cybernetics Corpannual revenue exceedsexpectationsS U C C E S SF A I L U R EInformation Assurance and Risk ManagementWithout With Information assurance andrisk management paysdividends for CeriousCybernetics CorpCerious Cybernetics Corp required topay a record settlement for loss of DoDIntellectual PropertyPage 6With only two main customers the risk associated with failing to comply with the customersobligations could cause a fatal loss of business.Calder (2009) states there are four key objectives for implementing Information Assurance and RiskManagement.Strategic requirements within contracts and rules governing the nature of businessrelationships imposed by the government and a decision by the board to better manageinformation security for the businessCustomer and Supplier confidence by demonstrating to customers and suppliers throughthe use of independent assurance and certification, that the company has adopted andimplemented information security best practice, CCC can gain a competitive advantage inthe market.Regulatory to meet statutory and regulatory requirements which are common to allbusiness and also specifically within this market sectorInternal effectiveness to make the organisation more efficient and effective whenmanaging information and to the risk and impact to the business of any event or data lossThese four objectives intersect in the following diagram from Calder (2009) to show that anInformation Security Management System (ISMS) can satisfy all four objectives.Figure 1 Four Objectives of an Information Security Management System (ISMS)Using StandardsProtecting and strengthening the business through Information Security (IS) should be a priority butimplementing IS is not about buying technology solutions. The ISO/IEC 27002:2017 standardsdocument states that Information security is achieved by implementing a suitable set of controls,including policies, processes, procedures, organizational structures and software and hardwarefunctions. Adopting a widely recognised framework helps guide the identification, assessment,selection, and implementation of controls. Customers and suppliers want to see that a commonframework so that measurability and assurance is achieved without prohibitive cost and effort tovalidate the organisations security posture.Page 7Information Assurance (IA) says MacLennan (2014) is the confidence that the organisation has donethe right thing based on standards and independent verification. An organisation may have the bestor worst information management practices but without a common measurement scale againstwhich to judge their effectiveness it would be difficult and expensive to seek assurance of otherorganisations or provide assurance of CCC. NIST (2014, Framework for Improving CriticalInfrastructure Cybersecurity) says that standards frameworks are a mechanism and taxonomy bywhich adherence can be measured.The BSIs Small business guide to standards, lists ten things standards can do for CCC1. Improve your goods and services2. Prove your commitment to quality3. Obtain new and keep existing customers4. Sharpen your business processes5. Cut costs and drive profitability6. Help ensure regulatory compliance7. Give your firm a competitive edge8. Help you to innovate9. Support your export efforts10. Strengthen your marketing pitchStandards will help with innovation as they allow a common vocabulary for communicationsbetween organisations. You can to describe the products and services you offer in marketable termsand with increased acceptance and adoption from customers as it removes the perception thatproducts and servers are proprietary. Standards frameworks enable increased speed bringingproducts to market and allows patents to be drawn up. Standards deliver competitive advantage (BSIInnovation The role of standards, no date).Selecting StandardsThere are three important standards frameworks that CCC should adopt as they are used andspecified by the two main customers. These are widely adopted, not proprietary, and offerassurance from an independent body.The three standards which provide independent assurance and certification are? ISO 27001? Cyber Essentials Plus? NIST 800-53The various ISO/IEC standards, supported by British Standards, are designed to interoperate and canbe developed by the organisation over time.The ISO 27001 standard is increasingly being demanded by customers and therefore increasinglybeing implemented by suppliers. Certifications for ISO 27001 increased by 18% in 2011 (Calder 2013)and 20% in 2015 (ISO 2015). This standard integrates with ISO 31000 & 31010 Risk Management, ISO22301 Business Continuity, ISO/IEC 20000 Service Management, and ISO 9001 Quality Management.It is supported by ISO 30301 Records Management, BS 7858:2012 People and HR Security, ISO/IECTR 18044:2004 Incident Management, BS ISO 28000 Supply Chain, and BS 13500 OrganisationalGovernance. Further information about these and others can be found in Appendix F SupportingStandards.Under the Defence Cyber Protection Partnership (DCPP) Guidance Update (2016), CCC must at aminimum obtain a Cyber Essentials Certificate to undertake new contracts with the MoD. Accordingto the Cyber Security Model (CSM) each new MoD contract awarded will be subject to a riskassessment and due to the sensitive information that CCC handles, a cyber-risk level of High mightbe expected. This would require CCC to obtain Cyber Essentials Plus that requires independentPage 8testing of systems. The DCPPs CSM also requires CCC to complete a supplier assurancequestionnaire to demonstrate, via an auditable self-assessment, that information security will beprovided against the level of risk assessed. Furthermore according to Insley of Defence Commercial(2017) it will be necessary in the future to apply the same degree of rigour to subcontracts from CCCto its suppliers.Cyber Essentials is a somewhat narrowly focused framework that is limited to boundary firewalls andinternet gateways, secure configuration, access control, malware protection, and patchmanagement. Cyber Essentials is required in addition to ISO 27001.NIST is another applicable standard as it is adopted by the DoD. The DoD in 2014 stated inInstruction Number 8510.01, policy statement b, that the DoD would adopt a Risk ManagementFramework (RMF) consistent with the principles of NIST Special Publication (SP)
800-37. And inpolicy statement d, that systems categorisation must be done in accordance to Committee onNational Security Systems Instruction (CNSSI) 1253, and that security controls from NIST SP 800-53be implemented and assessed by procedures detailed in NIST SP 800-53A. This approach supersedesthe previously used DoD Information Assurance Certification and Accreditation Process (DIACAP).The DoD, reports Marzigliano (2014), is taking a more risk focused approach using NIST forassessment & authorisation, risk assessment, risk management and dynamic continuous monitoringpractices.As explained in NIST SP 800-37 the RMF aims to provide continuous monitoring of risk so that nearreal-time risk management can be achieved while allowing senior leadership to make cost-effectiverisk decision for IT systems. It also promotes security by design so that architectural design anddevelopment deliver secure systems, links information risk management processes to organisationalrisk management processes, and defines responsibility and accountability for the security controlsthat have been deployed.NIST has the advantage over ISO in that it is freely available whereas ISO standards documents arepaid for per document. Cyber Essentials is also freely available. All require a fee for assurance andcertification activities.Given that ISO 27000 family of standards is one of the most widely recognised standards forinformation security and complements and aligns to the NIST, as seen in SP800-171 Appendix D, andcovers the Cyber Essentials frameworks elements, it is suitable for CCC to adopt it as a masterframework while a majority of the business comes from the MoD.More information on applicable standards can be found in Appendix F Supporting Standards.Implementing Standards FrameworksThe stages for implementing the ISO 27000 security framework is summarised as a diagram inAppendix G ISO27k_ISMS_implementation_and_certification_process_v4.pdfThe early stages requires senior management to provide strategy, direction, resources and supportto help define the scope. The next stage is to create an inventory or catalogue of assets. Assets arethe things that need to be protected, and for CCC this includes information systems, data, andintellectual property. Once the assets are know they can be assessed for risks, followed by a decisionon which risks need to be address. These decisions are recorded in a Statement of Applicability(SOA). See an example SOA in Appendix E Statement of Applicability.Risks that need to be addressed are added to a Risk Treatment Plan (RTP) that defines how andwhen the risk will be addressed. After which an ISMS programme is initiated to implement the ISMS.Guidance on implementation is available in ISO/IEC 27003.Page 9After implementing the ISMS programme the ISMS will need to be maintained through regular riskreviews and decision about enhancements to controls, often referred to as continuousimprovement, and driven by a Service Improvement Plan (SIP).Risk ManagementThe removal of information security risk and the assurance that the risks have been addressed is thepurpose of the information security frameworks. Risks need to be identified, recorded and assessed.The outcome of a risk management cycle should be an understanding of the identified in terms oflikelihood and consequences. This allows the prioritisation within a risk treatment plan (RTP).Guidance is available in BS ISO/IEC 27005:2011 for information security risk assessment. It is afocused subset that references the BS ISO 31000 risk management principles and guidelinesdocument, and BS EN 31010:2010 risk assessment techniques.The stages according to in BS ISO/IEC 27005:2011 are:Context establishment: Setting the scope to be a set of systems, a department, or organisationwide.Risk assessment: This includes? Identification of the risks: A good starting point would be to look at the controls in ISO27002 and understand for each asset which controls are missing. Other risks identificationmay come from audit reports or management consulting reports.? Analysis of the risk: What is the likelihood (the expected frequency or probability) andconsequences (in terms of disruption or financial impact)?? Risk evaluation: How important is the risk? Some risks may not need treatment. Others willbe a priority. Risks need to recorded on the risk register.Risk treatment: The treatment options area) reduce or modify riskb) accept or retain the riskc) avoid the riskd) share the risk (insurance or subcontracting to a third party)If a control is needed consider the treatment options in terms of ISO 27000, Cyber Essentials,and NIST controls. These controls probably cover a majority of the security controls requiredbut others may also be needed.Risk acceptance: The risk treatment plan (RTP), accepted risks, and residual risks require managerialapproval that the organisational needs will be metRisk communication: Information is shared between decision makers and stakeholders so that it isclear what decision have been taken and whyRisk monitoring and review: The introduction of new assets, changes in threats or vulnerabilities,changes to the impact and consequences, and security incidents are amongst the reasons formonitoring and reviewing. Maturity models typically rate maturity from 0 non-existent, 1 the leastcoverage for the control, up to 5 where the control is the matured. Review the risk mitigationcontrols against a maturity model such as BS ISO/IEC 15504 (or COBIT, CMMi, OPM3, SSE-CMM etc).An IG maturity model is published by ARMA (2013) and this provides a clear example of how amaturity model works. The maturity assessment score will guide improvements using the Plan-DoCheck-Act or similar service improvement plan (SIP).Page 10Assessing RiskRisks can have both positive and negative influences on the company. As the executive you will beasked to fund and prioritise activities based on risk and you may have to justify your decision in thefuture. How do you know if the assessment of risk is correct? Would another person make the sameassessment with the same information? Gigerenzer (2014) advocates absolute simplicity whencalculating risk using intuition and rules of thumb. How though can the risk decision be defended?Freund and Jones (2015) present a risk assessment technique named FAIR (Factor Analysis ofInformation Risk) which presents risks in an intuitive way which can be consumed without needing agreat deal of technical understanding about the risk.The advantage of FAIR is that it presents risk information in a concise manner which is easilyinterpreted through the use of FAIR risk factors. The decisions based on this information aredefensible as they give sufficient information to understand how a risk was evaluated compared tosay a High, Medium, Low assessment based on a hunch or gut-feeling. FAIR shows the assessedminimum, maximum and most likely occurrences along with the threat capability and threatcommunity influencing factors. This information when combined with the value assessment of yourassets will guide decisions for funding and prioritisation.Risk assessment using FAIR has these phases as summarised by Dixon (2009)Phase IIdentify the assetsIdentify the community of threatsPhase IIEvaluate the Loss Event Frequency through estimation of the threat frequency, threatcapability, strength of controls to device thePhase IIIEvaluate the Probably Loss Magnitude as a factor of monetary value for worst-case loss andestimated probably lossPhase IVDerive and articulate riskAlthough more quantitative than other methods, FAIR doesnt address risk appetite or tolerance anddoes not address risk treatment so is only useful at an early stage of risk assessment according toSutton (2014). It would be appropriate to the results from FAIR to feed into BS ISO/IEC 27005:2011and redefine the context, reviewing the risk assessment and creating a risk treatment plan.Risk identification can be asset led but may also consider cultural, political, legal, regulatory,financial, economic and competition factors at national and international level. Risk identificationmay also incorporate other sources such as management consultant or audit reports. Othermethodologies area available such as those offered by the Department of Homeland Security, NIST,Octave, CMS, however CCC should use BS ISO/IEC 27005:2011 for planning risk assessment,treatment, and monitoring as it will align more easily with ISO 27001, and use FAIR wherequantitative assessment is required.Current Risks, Vulnerabilities, Threats, and HazardsAs summarised in Appendix H Common Threats and Hazards it can be seen that many organisationsface the same information security issues.CCC also have military sector specific concerns for regulations and controls, contractual stipulations,Intellectual Property loss, espionage, advanced persistent threats (APT), information sharing, socialmedia, country and customer specific variations, access and use of data outside of the office, use ofpersonal devices, background checking of staff, and more.Page 11The list of identified legislation, regulation and contractual considerations are listed in Appendix BLegislation, Regulation, Contractual. These drivers along with an assessment of current controls hasguided the list of policies that will need to be written. The suggested policies are listed in Appendix CPolicies along with a suggested prioritisation based on the perceived risk.Risk Management in Action An ExampleIn List X (Cabinet Office, 2014) a number of compliance requirements are stated including inspection,organisational structures, visitor restrictions, supervision requirements, contingency plans,marketing and sales, export controls, asset protection, and home working.Looking specifically at the risk of home working data loss through theft, a concise risk managementreview is presented.Identification: List X stipulates controls on home working to protect sensitive dataAnalysis: Burglaries in Hertfordshire boroughs according to Police.UK (2017) is between four and sixper thousand people. Assuming an average dwelling occupancy of 2 people that increases the oddsto 12 per 1000 or a 1 in 83 chance (1000/12=83) that any house would be burgled leading to the lossof equipment and data. The average cost of data loss and incident handling has been valued at£50,000. The loss of sensitive data would necessitate an incident reporting process and consume alot of time and effort. Data may be recovered even when encrypted.Evaluation: There is a contractual obligation to adhere to List X. The ramifications of uncontrolleddata loss are significant, possibly leading to prosecution or fines and loss of contracts so this needsto be a priority. Record the risk on the risk register.Risk Treatment: There is currently no policy for remote or home working. A policy would addresswhen it is appropriate to work from home and what authorisation is required, what classification ofdata is allowed to be access, and how assets should be secured when not in use.Printed documentation and R&D models need to be stored securely when not in use in lockingfurniture of a safe.IT equipment will use strong encryption, strong passwords, and be enabled to auto lock after anagreed time. After multiple failed login attempts the device will be configured to auto-wipe.A risk assessment at the house may be required. Training and guidance are required as per List Xrequirements.An incident reporting process and an incidents register is needed with actions and definedresponsibilities.Communications: All staff will be made aware of the homeworking policy and controlsMonitoring and Evaluation: A record of all incidents related to home working will be kept so that afuture assessment can be made more accurately. The policies and authorisations for home workingwill be reviewed quarterly.Assurance and CertificationWith the controls are in place, and measurements defined with guidance from ISO/IEC 27004, andwith Business Continuity Planning (BCP) using ISO 22301 having taken place, CCC should be able tosatisfy an internal audit and a compliance review.Now is the time for an independent assessment. The British Assessment Bureau (2014) states thatISO 27001 certification can be achieved in 10-12 weeks and the certificate lasts three years subjectto at least annual reassessment. A Stage 1 audit assesses the current capabilities and defines theactions to complete before a Stage 2 audit which is the verification audit after which certification canbe recommended. This assessment is performed by an external accredited auditor who will decide ifcertification is the correct outcome.Page 12Instead of traditional Certification and Accreditation (C&A) NIST SP 800-37 specifies six steps toapply the Risk Management Framework (RMF). In order, these steps are categorise informationsystems, select security controls, implement security controls, assess security controls, authoriseinformation systems, monitor security controls. Independent assessment occurs but the finaldecision for certification remains with the system owner.Cyber Essentials assurance and can be achieved in two stages. Cyber Essentials which is largely selfassessed then verified independently, and Cyber Essentials Plus which has a higher degree ofassurance though independent vulnerability assessment. Recertification is required once a year ormore frequently if demanded by a commercial requirement.According to the MoD (2016) Defence Assurance and Information Security (DIAS) is applicable to ListX companies and requires that the Defence Assurance Risk Tool (DART) be used to register MoDindustry partners who connect to MoD information systems or processing of data marked asOFFICIAL-SENSITIVE or higher. The Risk Management Accreditation Document Sets (RMADS)captures the threats, vulnerabilities, assets, risks and mitigations, and allows an accreditor to assessthe risk posture and residual risk of a company. Depending on the method and information accessedCCC could be out-of-scope so further investigation is required to confirm the applicability.Organisational Structure ConsiderationsAlthough not directly applicable to CCC guidance document Security policy framework from HMG(2014) gives an indication of the sorts of organisation structures for security that may be imposed incontract terms. Indeed through List X, supplied by the Cabinet Office (2014), requires that a boardlevel appointment who is responsible for security and a Security Controller who is responsible forday to day security activities must be in post. Both must be a British Nationals. Given the size of CCCthis could be the same person.It is necessary to fully understand the role and the responsibilities of the Security Controller role,such as reporting security incidents of MoD data to the MoD Defence Industry Warning, Advice andReporting Point (WARP) in the Joint Security Co-ordination Centre (JSyCC).A Clearance Contact is required to perform clearance of staff. This is especially important for CCCgiven the reliance of agency staff. It is also a requirement of List X to manage who has access toinformation from visitors to staff.The IT Installation Security Officer is to take responsibility for networks and IT delivery and it is notenvisaged that a Crypto Custodian is required at this time.Organisation recommendations are made in more detail in Appendix K Organisational StructureRansomware and Service Improvement Plan (SIP)Ransomware is a threat that involves downloading malware on to the host device after triggering amacro delivered by a phishing or spam attack, or visiting a website. The malware encrypts filesbefore uploading a key and displaying a message asking for money to decrypt the files. Blackmail isanother variation where the threat of leaking documents to the public domain provides themotivation for payment of the ransom. See Figure 2 Ransomware: how hackers take your datahostage [AFP].Recent variations such as NotPetya are considered destructive-ware as the mechanism forencryption key recovery was not functional, as reported by Mathews (2017), leaving no option topay a ransom to recovery files. Kaspersky (2016) says that 1 in 5 who paid never get their files back.This would limit recovery to restoration of files from backups or possibly to invoke businesscontinuity and disaster recovery plans. Crowe (2017) reports that ransomware variants grew by afactor of 30x in 2016, Kaspersky (2016) claim an 11x increase by September 2016, with Crowe saying71 percent of companies attacked experiencing a successful ransomware incident. Only 33 percentPage 13(Kaspersky) to 58 percent (Crowe) of companies were able to fully recover data from backups.Others were forced to pay or suffer the loss of data.The phycology of ransomware demands victims to act quickly says Hadlington (2017). However thisshould not be a time to panic but to follow a well-defined checklis