Regulator Interview Lab
The breach is contained; then a regulator asks for a “voluntary” chat. Now the hard part: how do you answer truthfully without conceding “unreasonable security”, how do you handle a document request and a litigation hold, what is protected by privilege, and which admissions sink you? Sit across the table from the FTC, the SEC, a state Attorney General or a data-protection authority and make each call the way counsel would — route it through counsel, never speculate on the record, frame the program as reasonable rather than perfect, preserve every record and destroy none. Each decision shows you why.
Pair this drill with the free Post-Breach Regulator Response Prep Sheet — the document that readies the team for the call you practise here. Educational drill, not legal advice.
The real job. More noise, a tighter clock.
The breach is behind you; now a regulator wants a word. You are in the room for a post-breach enforcement interview — an FTC, SEC, state Attorney General or data-protection inquiry. Work 10 decisions — answer truthfully without conceding “unreasonable security”, protect privilege, and avoid the admissions that create liability — then see why. You are graded on how many you get right against the clock.
What this lab is
- A free, browser-based decision drill on facing a post-breach regulator or enforcement interview — FTC, SEC, a state Attorney General or a data-protection authority — where you work ~14 decisions about how to answer, what to produce and what to never concede.
- The legal standard regulators apply is REASONABLE security, not perfect security: you frame your program against a recognized framework (NIST CSF / ISO 27001), you do not claim perfection, and you do not concede "unreasonable security".
- You practise the real traps: routing every question through counsel, never speculating on the record, the litigation hold and the obstruction risk of destroying records (cf. the Uber case), legal privilege and how it is waived, the single-spokesperson protocol, and voluntary vs compelled process.
- Each decision reveals why the defensible answer is right, and you are graded S–D on how many you call correctly against the clock.
- Educational decision drill — not legal advice. Pair it with the free Post-Breach Regulator Response Prep Sheet template.
Frequently asked questions
What is the Regulator Interview Lab?
A free, in-browser decision simulation that puts you in a post-breach enforcement interview with a regulator — the FTC, SEC, a state Attorney General or a data-protection authority. You work through decisions — route it through counsel or answer on the spot, how to frame the program, what to produce, what to never concede — and each one has a single defensible answer, revealed after you lock in your call.
What does "reasonable security" mean here?
Regulators such as the FTC and state Attorneys General judge a company against a standard of reasonable, risk-appropriate security — not perfect security and not a specific technology. In an interview you describe a risk-based program mapped to a recognized framework (for example NIST CSF or ISO 27001). Claiming the program was perfect is not credible after a breach, and conceding it was "inadequate" hands the enforcer the "unreasonable security" finding that drives liability.
Is this legal advice?
No. The lab is an educational drill and the regulatory references (the FTC Act, the Safeguards Rule, state data-security laws, litigation hold, spoliation, privilege) are summarised for orientation and can change. Always confirm the current requirements and apply them to your specific facts with qualified counsel.
Who is it for?
CISOs, general counsel, privacy officers, CFOs, communications leads and board directors — anyone who could be in the room, or preparing the people who are, when a regulator comes asking questions after a security incident and wants to rehearse the interview before it is real.