All tabletop exercises
Data breach·Starter·Mixed audience
Lost laptop with HR files at an airport
The prompt — read this to the room
A regional HR manager reports on Monday morning that she left her laptop in an airport security tray on Friday evening. She waited because she hoped the airport would find it. The device management console shows it last checked in on Saturday at 09:12 from an unknown home network. Disk encryption shows 'pending' because a policy change was never completed on her model. The laptop held disciplinary files and a local copy of an investigation into a senior manager. What do you do first, and is this a notifiable breach?
Total duration
1 h 15 min
People to involve
5
Best fit
Any sector
Who to involve
Most important first.
- IT operations
- Privacy officer / DPO
- HR
- Legal counsel
- CISO / Head of security
What it tests
- Decide on remote lock and wipe for a device that has been online since it was lost.
- Establish whether encryption was actually active, and how that changes notification.
- Assess the harm from disciplinary and investigation data, and who must be told.
- Find and close the gap that left a device unencrypted.
Outline of activities
- 1The report: three days late
- 2Lock, wipe and what the console really says
- 3Was it encrypted? Assessing harm
- 4Notification and the people in the files
- 5Hot wash
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…