All tabletop exercises
Data breach·Advanced·Executive audience
Is it material? The 8-K clock after a data theft
The prompt — read this to the room
You are a listed software company. On Monday the security team confirmed that an attacker took source code and a database of 1.1 million customer contact records through a compromised build server. Revenue impact is unclear, and two large customers have asked whether their API keys were exposed. The disclosure committee meets Wednesday morning. Once you determine the incident is material, you have four business days to file. Some in the room want to wait for the forensic report due in three weeks. Others think the decision is already overdue.
Total duration
2 h 30 min
People to involve
6
Best fit
Saas, Finance
Who to involve
Most important first.
- Legal counsel
- CFO / Finance
- CEO / Managing director
- CISO / Head of security
- Board member
- Communications / PR
What it tests
- Run a materiality assessment that considers qualitative as well as quantitative factors
- Show that the determination was made without unreasonable delay and is documented
- Draft the outline of an Item 1.05 disclosure that describes impact without giving attackers a roadmap
- Align the filing with customer, investor and employee communications so no audience hears it second-hand
Outline of activities
- 1What security knows on Monday, and how it reaches the disclosure committee
- 2The materiality debate: numbers, customers, reputation, regulators, litigation
- 3Decision and documentation: when was the determination made, and by whom
- 4Drafting the 8-K and the parallel customer message
- 5New facts after the filing: amend, update, or wait
- 6Debrief: fixing the escalation path from SOC to disclosure committee
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…