All tabletop exercises
OT / ICS·Starter·Mixed audience
The NIS2 24-hour early warning
The prompt — read this to the room
You run IT for a mid-sized water utility in the EU, classed as an essential entity under NIS2. At 06:30 monitoring shows that the remote-access gateway used by contractors has been accepting logins from an unfamiliar country for two nights, and the telemetry server it reaches is behaving oddly. Nothing has failed, and operations say pumping is normal. The national CSIRT expects an early warning within 24 hours of becoming aware of a significant incident. Is this significant, when did the clock start, and who sends it?
Total duration
1 h 30 min
People to involve
6
Best fit
Public
Who to involve
Most important first.
- CISO / Head of security
- OT / plant engineer
- IT operations
- Legal counsel
- CEO / Managing director
- Communications / PR
What it tests
- Apply the NIS2 significance test to an ambiguous, still-developing event
- Agree when the organisation became aware and record the reasoning
- Send a proportionate early warning with the right content, from the right person, on time
- Plan the 72-hour incident notification and the information it will need
Outline of activities
- 1The alert and what operations can see on the plant side
- 2Is this significant? Applying the test with incomplete facts
- 3When did we become aware, and who decides
- 4Writing and sending the early warning
- 5Looking ahead to the 72-hour notification and the final report
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…