What your status page says while you investigate a breach
The prompt — read this to the room
Your project-management SaaS has been degraded for six hours. Officially the cause is 'database performance'. In reality the security team took two clusters offline after finding an attacker's web shell on an API server, and nobody yet knows whether customer data was accessed. The public status page still shows a yellow 'degraded' banner. Enterprise customers are asking about SLA credits, two have asked outright whether this is a security incident, and one has a contractual 48-hour breach-notice clause. Sales wants the status page to say 'scheduled maintenance'. What does the status page say now?
Who to involve
Most important first.
- CEO / Managing director
- CISO / Head of security
- Communications / PR
- Legal counsel
- Customer support
- CFO / Finance
What it tests
- Agree status-page wording that is truthful without running ahead of the investigation
- Map contractual breach-notice and SLA obligations, and name who tracks them
- Answer direct customer questions consistently across support, sales and executives
- Decide the SLA-credit approach separately from breach liability
Outline of activities
- 1Six hours in: the gap between the status page and reality
- 2What the status page says now
- 3Contract clocks: SLA credits and breach-notice clauses
- 4One answer for customers who ask directly
- 5Next update and the disclosure plan
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…