All tabletop exercises
Physical·Starter·Mixed audience
Overnight break-in: eleven laptops and the branch file server gone
The prompt — read this to the room
Police call your office manager at 06:30: a ground-floor window at your accounting firm’s branch office was smashed overnight. When staff arrive they find eleven laptops missing from desks, plus the small network storage box from the comms cupboard that the branch used for scanned client documents. IT believes the laptops are encrypted but is not sure about two older ones. Nobody knows exactly what was on the storage box or whether it was backed up. Tax season starts in three weeks. Is this a theft or a data breach?
Total duration
1 h
People to involve
6
Best fit
Finance, Professional-services
Who to involve
Most important first.
- IT operations
- Privacy officer / DPO
- CISO / Head of security
- Physical security / facilities
- Legal counsel
- CEO / Managing director
What it tests
- Determine quickly whether each stolen device holds readable personal data.
- Apply encryption safe harbours correctly and know where they do not apply.
- Decide on client and regulator notification with evidence, not assumptions.
- Get the branch working again before the busy season.
Outline of activities
- 1The break-in and the inventory of what is missing
- 2Device by device: encrypted, managed, backed up?
- 3The storage box: what was on it and who could read it
- 4Notification decision and client communication
- 5Restoring the branch and closing gaps
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…