All tabletop exercises
Data breach·Intermediate·Mixed audience
The regulator writes after a public leak
The prompt — read this to the room
A security researcher posted on social media that your insurance comparison site had left a storage bucket of 80,000 quote applications open to the internet. You closed it within an hour and decided, after a quick assessment, that it did not need to be notified. Eleven days later a letter arrives from the data protection authority. It asks when you became aware, who accessed the data, why you did not notify, and for a copy of your breach register entry. Replies are due in 14 days. Your breach register entry is two lines long.
Total duration
1 h 30 min
People to involve
6
Best fit
Finance
Who to involve
Most important first.
- Privacy officer / DPO
- Legal counsel
- CISO / Head of security
- Cloud engineer
- Communications / PR
- CEO / Managing director
What it tests
- Reconstruct the timeline and the original risk assessment honestly from available evidence
- Decide whether the original no-notify decision still stands, and what to do if it does not
- Draft a regulator response that is accurate, complete and consistent with public statements
- Fix the breach register and decision-recording process going forward
Outline of activities
- 1The letter and the deadline
- 2What really happened: access logs, the researcher, the assessment
- 3Revisiting the decision not to notify
- 4Drafting the response and the supporting evidence pack
- 5Debrief: what a defensible breach record looks like
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…