Free scenario
Your vendor was breached. Your customers are asking you.
A supplier breach tabletop you run yourself, with your own leadership team. The brief and all four injects are on this page. The printable pack adds the notes for whoever runs it, and your email is optional.
What it is
A 3-hour third-party breach exercise for 6 to 12 people, run by somebody inside your company. It is a discussion exercise. Nothing is switched off and no live system is touched.
It is the hardest of the three to run, and that is the point. In your own incident you can look at something. Here there is nothing to look at, and every hour the room spends trying to establish what happened is an hour not spent deciding what to say. The skill being tested is acting on somebody else's timetable, which is the skill nobody practises.
The vendor holds the data and runs the forensics. The accountability does not move with it. Canada's federal privacy law says an organization "is responsible for personal information in its possession or custody, including information that has been transferred to a third party for processing" (Personal Information Protection and Electronic Documents Act). That is why the fourth inject matters. When the vendor hands you its findings, accepting them is still your decision.
Every detail is fiction. Swap the platform, the data types and the timeline for yours.
The short version
Read the brief aloud about fifteen minutes in. Nobody sees it beforehand. Then give the room one inject at a time, at the elapsed times shown. One rule: no solving. The room will want to keep chasing the vendor. Keep asking who decides and by when. Leave the last half hour for a debrief.
The brief read aloud at 0:15
It is 11:20 on a Wednesday. A client forwards your head of operations a news article. A payroll and HR platform used by several thousand companies has disclosed a breach. You are one of their customers.
The article says data was taken over about six weeks and that affected customers are being contacted directly. You have not been contacted. Your account manager’s number goes to voicemail and the vendor’s status page says they are investigating.
Your HR lead confirms what sits in that platform: names, home addresses, dates of birth, social insurance numbers and banking details for every employee, plus every contractor for the last four years.
By 11:45 two clients have emailed. Both have a clause requiring you to tell them about security incidents affecting your suppliers, and both want to know whether this is one. Your staff channel already has the article in it.
Stop there. Questions only, no solutions. Then start the clock.
-
Inject 1 at 0:25
The vendor has said something, and it says nothing.
11:50. The status page updates: a subset of customer data was accessed, affected customers are being contacted, external counsel has been engaged. Your account manager replies with one line, that they will be in touch as soon as they have more. Your IT lead can export a list of what your company holds there, but not before end of day.
The decision it forces. Who owns this, the one question you put to the vendor in writing today, and what you do while you wait.
-
Inject 2 at 0:55
Cut the connection, and payroll runs on Friday.
13:30. Your IT lead recommends revoking the platform’s access and suspending the integration until scope is confirmed. Payroll runs Friday, and suspending it means doing that manually for the first time in four years. The vendor adds that a suspension may slow their ability to give you answers about your own tenant.
The decision it forces. Cut or keep, who authorizes it, and what staff are told about Friday.
-
Inject 3 at 1:40
Two audiences, and one of them works here.
Thursday, 09:00. Your largest client sends a security questionnaire and wants a written statement by end of day. At the same time an employee asks in the staff channel whether their social insurance number is out there, and forty people have reacted to it.
The decision it forces. What you put in writing to the client, what you say to staff, and which of the two happens first.
-
Inject 4 at 2:10
The vendor has done your assessment for you.
Tuesday. The vendor confirms your tenant was in scope, that names, addresses and dates of birth were taken and that banking details were not, on their forensics. They will notify affected individuals themselves and ask you to send any questions to them.
The decision it forces. Whether their forensics are your assessment, who tells your employees, and what you record.
What the printable pack adds
Five pages, set for print, free to copy and adapt inside your own organization. Everything on this page, plus the parts written for whoever runs the session:
- Notes on every inject: what to push the room on, and what a good answer sounds like.
- A sheet for whoever runs it on where rooms get stuck, held back from the room.
- A reserve inject for a room that moves fast, and when to use it.
- A capture sheet for the scribe, so decisions and times are written down as they happen.
- Four things to check in your contracts in the month after.
Keep those pages with whoever runs it. They tell the facilitator what the room is meant to find out for itself.
When to use it, and when it is the wrong thing to reach for
Use it if the data you would least like to lose sits on somebody else's platform, which for most companies of this size is payroll, human resources, the document store or the customer database. It is also the right exercise if your client contracts oblige you to report incidents at your own suppliers and nobody has read those clauses recently.
It is the wrong thing to reach for if you want a room that can investigate its way to an answer. Nothing here is knowable from inside your company. If you want the technical response tested, use the ransomware pack. If the exposure is money rather than data, use the business email compromise pack.
It does not produce third-party attestation, and page one of the pack says so. Everything the session generates is yours to keep. The attestation is not, and in a supplier breach it is the only document in the file that is about your own conduct rather than your vendor's.