1. Setting the Scene
These slides can be appended before the specific incident slides.
Change the master slides to fit your company brand or templates
This work is licensed under a Creative Commons Attribution 4.0 International License.
Remember to delete this slide!

2. Gold team exercise Date| Time
Cyber Incident
Gold team exercise
Date| Time

3. Agenda
Introductions
Rules
Objectives
Roles
Off we go ...
Wrap-up

4. Introductions What’s your name and where do you come from?
Your role today?
What do you personally want to get out of the next 120 minutes?

5. Rules This is a very safe place It’s fine to pause, stop, think
If you feel pressured,
say so
Have fun

6. It’s fine to say “I don’t know”
We’re all here to learn…

7. Learning Objectives Gaps in our knowledge Gaps in our processes
Gaps in our technology
Things we can do better
Training our breach response in a safe way

8. Roles Gold Command Record Keeper Exercise Observer(s)
Catcher of Lessons
Learned

9. This is a role play – do what you would normally do
I’m not here to lead the incident or give advice.
I will ask questions: “How? Who? Why?”
I will be anyone we need who is not
in the room and available.
There will be some scenario developments –
but not as many as you might expect.

10. Don’t argue
with the scenario
Just run with it

11. We will have an incident that reaches gold sometime

12. Any Questions?