All tabletop exercises
Crisis·Starter·Executive audience
The CEO is on a plane and the decision cannot wait
The prompt — read this to the room
At 14:10 on a Friday your online store is taken offline by an attack that has encrypted the order database. The CEO is on a 14-hour flight with no reliable connectivity and lands tomorrow morning. The COO is on leave. Someone has to decide whether to shut down the payment gateway, whether to tell customers, and whether to engage an incident response firm that wants 250,000 dollars up front. The incident plan says 'the CEO approves'. It says nothing else.
Total duration
1 h 15 min
People to involve
6
Best fit
Retail
Who to involve
Most important first.
- CISO / Head of security
- CIO / CTO
- CFO / Finance
- Legal counsel
- Communications / PR
- Board member
What it tests
- Find out whether a written delegation of authority exists and whether people know about it
- Make the three time-critical decisions with a clear, recorded basis for who made them
- Decide how and when the absent CEO and the board are brought up to date
- List the plan changes needed so no single absent person blocks a response
Outline of activities
- 1The attack and the three decisions on the table
- 2Who is in charge: searching the plan, the bylaws and the org chart
- 3Making the calls: payment gateway, customers, the IR firm
- 4Reaching the CEO and the board chair
- 5Debrief: writing the succession and spending authority into the plan
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…