Designing Breach Simulation Exercise

Designing Breach Simulation Exercise

Overview

Breach simulation exercises (tabletop exercises) test an organization's ability to detect, respond to, and recover from a personal data breach without the consequences of an actual incident. A well-designed exercise validates the breach response plan, identifies gaps in procedures, communication, and decision-making, and builds institutional muscle memory. This skill covers the end-to-end design process from scenario creation through after-action reporting.

Exercise Design Framework

Exercise Types

Recommended Exercise Cadence

Scenario Design

Scenario 1: Ransomware Attack on Customer Database

Complexity: High Duration: 3 hours Primary objectives: Test Art. 33 72-hour notification decision-making, executive communication, and vendor coordination.

Background briefing (distributed 24 hours before exercise): Stellar Payments Group processes payment transactions for 15,230 account holders across 18 EU member states and 12 US states. The production customer database is hosted on a PostgreSQL cluster in AWS eu-west-1. The DPO is Dr. Elena Vasquez. The CISO is Thomas Brenner. Mandiant is the retained incident response firm.

Inject timeline:

Scenario 2: Insider Threat — Employee Data Exfiltration

Complexity: Medium Duration: 2.5 hours

Inject timeline:

Scenario 3: Third-Party Processor Breach

Complexity: Medium Duration: 2 hours

Inject timeline:

Participant Roles

Decision Points to Evaluate

1. Breach awareness determination: When exactly did the controller "become aware" for Art. 33 clock purposes?
2. Containment vs. evidence preservation: Did the team balance immediate containment with the need to preserve forensic evidence?
3. Notification timing: Was the 72-hour deadline tracked and met?
4. Risk assessment quality: Was the risk assessment methodology applied consistently and documented?
5. Communication coordination: Were media, customer, and internal communications coordinated and consistent?
6. Escalation effectiveness: Were the right people involved at the right time?
7. Cross-functional coordination: Did legal, privacy, IT, and communications work together effectively?
8. Regulatory coordination: Was the correct supervisory authority identified and notification prepared?
9. Data subject communication: Was Art. 34 notification considered at the appropriate threshold?
10. Documentation: Was the decision-making process documented in real-time?

After-Action Report Structure

Section 1: Exercise Summary

• Exercise date, duration, scenario, and participants.
• Exercise objectives and whether they were met.

Section 2: Timeline Analysis

• Actual timeline of decisions and actions during the exercise.
• Comparison against expected/ideal timeline from the breach response plan.
• Identification of delays and bottlenecks.

Section 3: Findings

• What worked well (strengths to maintain).
• What needs improvement (gaps and deficiencies).
• Severity rating for each finding: Critical, Major, Minor, Observation.

Section 4: Recommendations

• Specific, actionable remediation recommendations with owners and deadlines.
• Prioritized by severity.

Section 5: Metrics

• Time from detection to containment decision.
• Time from awareness to DPO notification.
• Time from awareness to notification preparation completion.
• Communication consistency score (number of conflicting messages identified).
• Decision quality score (percentage of decisions aligned with policy and regulation).