All tabletop exercises
Crisis·Starter·Mixed audience
A journalist calls before you know anything
The prompt — read this to the room
At 16:45 the communications team takes a call from a reporter at a national business publication. She says a source has shown her files that appear to come from your HR system, including salary data for senior staff, and she plans to publish tomorrow morning. She wants a comment by 20:00. Your security team has no open incident, no alert matches, and nobody has seen the files. You have three hours and fifteen minutes to find out whether it is true and decide what you will say.
Total duration
1 h
People to involve
6
Best fit
Any sector
Who to involve
Most important first.
- Communications / PR
- CISO / Head of security
- Legal counsel
- HR
- CEO / Managing director
- SOC analyst
What it tests
- Verify or rule out a claimed leak quickly using what the reporter can share
- Produce a holding statement that is true whatever the investigation finds
- Decide how and when to tell employees whose data may be in the story
- Set rules for who talks to the media and how further contact is logged
Outline of activities
- 1The call and what the reporter actually said
- 2Rapid verification: samples, file metadata, likely sources
- 3The holding statement
- 4Staff, the board and the morning after
- 5Debrief: a media-first playbook
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…