All tabletop exercises
Data breach·Intermediate·Mixed audience
A departing salesperson takes the customer list
The prompt — read this to the room
A senior account executive resigned on Friday and joins a direct competitor in two weeks. On Monday, a data loss alert shows she synced 4,000 files to a personal cloud account over the weekend, including a full CRM export, pricing models and the customer contract folder. She is on garden leave but still has a working laptop and VPN access. Her manager insists she is trustworthy and that this is 'just her portfolio'. Legal wants to act before anything reaches the competitor. What do you do, and in what order?
Total duration
1 h 45 min
People to involve
6
Best fit
Saas, Finance
Who to involve
Most important first.
- Legal counsel
- HR
- CISO / Head of security
- IT operations
- Privacy officer / DPO
- CEO / Managing director
What it tests
- Preserve evidence in a way that would hold up in civil proceedings or a regulator inquiry.
- Sequence access removal, the employee conversation and legal steps so that none undermines the others.
- Decide whether customer personal data in the export creates a notification obligation.
- Identify the gaps in leaver and garden-leave procedures.
Outline of activities
- 1The alert: verifying what left
- 2Preserving evidence and cutting access
- 3The conversation, the lawyers and the competitor
- 4Personal data and customers
- 5Hot wash
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…