All tabletop exercises
Crisis·Intermediate·Executive audience
Briefing the board in the first 24 hours
The prompt — read this to the room
It is 07:40. Overnight your SOC confirmed that an intruder has had access to the customer database for at least nine days. Containment is under way but not finished. The chair has heard a rumour from another director and wants a call with the full board at 18:00 today. You do not yet know how many records were taken, whether the attacker is still inside, or whether a regulatory clock has started. You have ten hours to decide what the board needs to hear, who says it, and what you will refuse to guess at.
Total duration
2 h
People to involve
6
Best fit
Any sector
Who to involve
Most important first.
- CISO / Head of security
- CEO / Managing director
- Board member
- Legal counsel
- CFO / Finance
- Communications / PR
What it tests
- Produce a first board briefing that separates confirmed facts, working assumptions and unknowns
- Agree which decisions belong to the board and which stay with management during the incident
- Set a briefing cadence and a trigger list for calling the board again before the next scheduled update
- Keep legal privilege and disclosure obligations in view when deciding what goes in writing
Outline of activities
- 1Morning: the facts the CISO actually has, and the pressure to fill gaps
- 2Drafting the briefing: facts, assumptions, unknowns, decisions needed
- 3Rehearsal: the CEO and CISO present while directors probe
- 4New information lands an hour before the call
- 5The live board call and the decisions it produces
- 6Debrief: what the board needs on paper before the next incident
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…