All tabletop exercises
Data breach·Advanced·Executive audience
One breach, five notification clocks
The prompt — read this to the room
Your investigation confirms that an attacker had access to a customer support platform for 19 days. It held records for 210,000 people across the EU, the UK, California, Texas and Australia, and some records include government ID numbers. The company is listed in the US and provides services to several EU banks. Outside counsel joins at 10:00 and lays out at least five deadlines, some measured from 'awareness' and some from 'determination'. The board chair wants to know when this becomes public. When did each clock start, and what goes out first?
Total duration
2 h 30 min
People to involve
7
Best fit
Finance, Saas
Who to involve
Most important first.
- Legal counsel
- Privacy officer / DPO
- CISO / Head of security
- CEO / Managing director
- Board member
- Communications / PR
- CFO / Finance
What it tests
- Map each obligation (GDPR, UK GDPR, US state laws, Australia’s Notifiable Data Breaches scheme, SEC Item 1.05, client contracts) to its trigger and deadline.
- Run and document a materiality determination for SEC disclosure.
- Sequence regulator, client, customer and public communications so no group learns from another.
- Keep one source of truth for facts across every notice.
Outline of activities
- 1Counsel’s list: what applies
- 2When did we become aware? Reconstructing the timeline
- 3Materiality and the disclosure committee
- 4Sequencing the notices
- 5One set of facts across every draft
- 6Hot wash
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…