# Lab 5.1 - Tabletop Role Cards
# Chapter 5: Cybersecurity Compliance and Management
# Scenario: Monday 07:40 ransomware incident

Print or display one card per participant. The facilitator keeps the inject sequence sheet.
Stay strictly in role throughout the exercise. Log every unowned decision and untested assumption
as it surfaces - do not stop to fix anything during the exercise.

---

## ROLE: CISO (Chief Information Security Officer)

You are accountable for the organisation's security posture and incident response capability.

**Your responsibilities in this scenario:**
- Declare whether this constitutes a security incident under your IR policy.
- Activate the incident response team and initiate the IR plan.
- Advise on technical containment options (network isolation, shutting down systems).
- Determine whether the backup infrastructure is unaffected.
- Provide technical input to the ransom decision and the regulatory notification decision.

**Questions you must be ready to answer:**
- Do you have standing authority to isolate network segments without approval?
- Is there a named delegate if you are unavailable?
- When did you last verify the backup restore process end-to-end?
- Do you have the IR plan documented and accessible offline?

---

## ROLE: Legal Counsel (General Counsel / outside counsel)

You advise on legal obligations, liability, and the legality of any ransom payment.

**Your responsibilities in this scenario:**
- Advise whether paying the ransom is lawful (sanctions exposure, cryptocurrency regulations).
- Identify which regulatory notification obligations have been triggered and their deadlines.
- Advise on evidence preservation for any future regulatory investigation or litigation.
- Draft or approve any external communications before release.
- Advise on contractual notification obligations to customers and partners.

**Questions you must be ready to answer:**
- Is the ransom demand from a sanctioned entity or jurisdiction? How would you find out?
- Who has authority to authorise a ransom payment?
- What is the threshold for notifying customers contractually?
- Can you approve a public holding statement within one hour?

---

## ROLE: Head of Communications (PR / Communications Director)

You manage all internal and external messaging about the incident.

**Your responsibilities in this scenario:**
- Prepare a holding statement for external enquiries (press, social media).
- Manage internal communications so staff understand what to say (and not say) externally.
- Coordinate with Legal before any statement is released.
- Draft the customer notification communication if required.
- Monitor social media and press for developing coverage.

**Questions you must be ready to answer:**
- Do you have a pre-approved holding statement template?
- Who approves external statements, and can they be reached at 07:40 on a Monday?
- What is your policy on employees posting about incidents on social media?
- Do you have a dedicated incident communications channel (separate from affected systems)?

---

## ROLE: Head of IT Operations

You are responsible for infrastructure, backups, and system recovery.

**Your responsibilities in this scenario:**
- Confirm the scope of encryption: which systems, which backups.
- Report on the last verified backup restore, the estimated clean restore point, and recovery time.
- Implement technical containment as directed by the CISO.
- Provide the technical basis for the recover-vs-pay decision.
- Coordinate with any third-party infrastructure providers.

**Questions you must be ready to answer:**
- When was the last successful end-to-end restore test (not just backup verification)?
- How long would a full restore take? Is that number measured or estimated?
- Are the backup systems on a separate network and separate credentials from production?
- Do you have an offline copy of system passwords and recovery keys?

---

## ROLE: Executive (CEO or equivalent)

You hold ultimate decision authority for the organisation and represent the board.

**Your responsibilities in this scenario:**
- Make the ransom payment decision (or confirm who has delegated authority to do so).
- Approve the decision to notify regulators and affected customers.
- Approve any significant expenditure (incident response contractors, ransom payment).
- Receive briefings from CISO, Legal, and Communications and make the key calls.

**Questions you must be ready to answer:**
- Has the board agreed a policy on ransom payments?
- Do you have a pre-agreed communications escalation path to the board?
- What is your organisation's crisis decision-making structure? Who quorums?
- Are you personally briefed on the GDPR Article 33 72-hour clock and what it requires?

---

## ROLE: Data Protection Officer (DPO)

You are responsible for GDPR compliance and personal-data breach notifications.

**Your responsibilities in this scenario:**
- Determine whether personal data was or may have been exfiltrated.
- Start the GDPR Article 33 72-hour notification clock once personal-data involvement is confirmed.
- Draft the supervisory authority notification (Article 33) and advise on data-subject notification (Article 34).
- Advise on evidence required for the notification (nature of breach, categories of data, approximate number of individuals).
- Confirm the notification route to your competent supervisory authority.

**Questions you must be ready to answer:**
- Which supervisory authority is your lead authority, and do you have their current notification contact?
- Do you have a pre-drafted Article 33 template?
- How will you determine how many individuals are affected before the 72-hour clock expires?
- What is the threshold for Article 34 notification to data subjects?

---

## FACILITATOR GUIDE - Inject Sequence

Introduce the scenario and inject each item in order. Allow the group to respond before moving on.
Log every unowned decision and untested assumption on a whiteboard or shared doc.

**Opening (read aloud):**
"It is Monday, 07:40. The overnight service desk reports that the customer database is
unreachable and a ransom note has appeared on three servers. No one has yet confirmed the
scope of encryption. You are all now in an emergency call."

**Inject 1 - Scope expansion (introduce after opening discussion settles):**
"The file-share and the backup server are also encrypted. The EDR console shows the same
process ran on a domain controller. You now suspect the backup infrastructure is compromised."

**Inject 2 - The ransom demand (introduce after Inject 1 is worked):**
"The attackers email a demand for EUR 1.5 million in cryptocurrency, payable within 48 hours.
They claim to have exfiltrated 200,000 customer records and provide a sample of ten records
as proof."

**Inject 3 - Personal data confirmed (introduce after Inject 2 is worked):**
"Your DPO has confirmed that the exfiltrated records include names, email addresses, and
encrypted payment tokens. This is a personal-data breach. The GDPR Article 33 72-hour
notification clock has now started."

**Inject 4 - Press enquiry (introduce after Inject 3 is worked):**
"A journalist emails asking about 'reports of a major outage.' An employee has already posted
about the incident on LinkedIn. A customer has called the main switchboard asking if their data
is safe."

**Inject 5 - Recovery decision (introduce after Inject 4 is worked):**
"IT Operations confirms that a full restore from backup will take an estimated five days minimum,
and that the last verified end-to-end restore test was 14 months ago. The business development
team asks whether paying would be faster."

**After all injects - Debrief:**
Review every item logged during the exercise. Produce the gap list (see README for format).

---

*This is a fictional scenario. No live systems are involved. All figures (EUR 1.5 million demand,
200,000 records) are illustrative. Authorisation note: no special permission is required for
this exercise.*
