Setting the Scene These slides can be appended before the specific incident slides. Change the master slides to fit your company brand or templates This work is licensed under a Creative Commons Attribution 4.0 International License. Remember to delete this slide!

Gold team exercise Date| Time Cyber Incident Gold team exercise Date| Time

Agenda Introductions Rules Objectives Roles Off we go ... Wrap-up

Introductions What’s your name and where do you come from? Your role today? What do you personally want to get out of the next 120 minutes?

Rules This is a very safe place It’s fine to pause, stop, think If you feel pressured, say so Have fun

It’s fine to say “I don’t know” We’re all here to learn…

Learning Objectives Gaps in our knowledge Gaps in our processes Gaps in our technology Things we can do better Training our breach response in a safe way

Roles Gold Command Record Keeper Exercise Observer(s) Catcher of Lessons Learned

This is a role play – do what you would normally do I’m not here to lead the incident or give advice. I will ask questions: “How? Who? Why?” I will be anyone we need who is not in the room and available. There will be some scenario developments – but not as many as you might expect.

Don’t argue with the scenario Just run with it

We will have an incident that reaches gold sometime

Any Questions?