4

Tabletop Exercises

SL-07

Testing the plan before it is tested for you. Bi-annual exercises are part of the breach retainer, and the findings feed the gap register rather than a slide deck nobody reads again.

DischargesS.8(6)R.7R.6
Exercises
3
Completed
1
Scheduled
2
Average score
72%

Exercises

H1 FY2026-27 breach simulationcompleted

Compromised service account extracts 150,000 citizen records overnight; detection at 03:00; Board clock starts immediately.

Held
02 May 2026
Participants
18
Facilitator
Sentinel SOC Partners
Completed
3 months ago
Findings
  • Impact assessment took 6 hours; target is 2. Discovery coverage of the warehouse was the bottleneck.
  • No pre-approved Data Principal notification template existed in Hindi.
  • Escalation to the Principal Secretary was delayed by an out-of-date contact list.

Each finding was raised as a gap and is tracked in the remediation roadmap.

Processor-reported breach exercisescheduled

A processor reports a breach 40 hours after becoming aware, leaving 32 hours on the Board clock.

Scheduled for
09 September 2026
Participants
14
Facilitator
Meera Iyer
In
next month
14 participants invited
Children's data exposure exercisescheduled

Public exposure of scholarship records affecting 9,800 children; media attention within 4 hours.

Scheduled for
17 October 2026
Participants
16
Facilitator
Sentinel SOC Partners
In
in 2 months
16 participants invited
What a good exercise tests

Not whether people know the plan exists, but whether the plan survives contact with a clock.

  • How long impact assessment actually takes
    The gap between the target and the reality is almost always a discovery coverage problem.
  • Whether notification templates exist in the right languages
    Drafting a bilingual Data Principal notification under time pressure produces bad copy.
  • Whether the escalation list is current
    The most common failure, and the easiest to fix in advance.
  • Who is authorised to file with the Board
    If that authority is ambiguous, the 72-hour deadline becomes a negotiation.
  • What happens when a processor reports late
    Their notification starts your clock, which may already be 40 hours old.
  • Whether containment and evidence preservation conflict
    They often do, and the decision should be made in advance rather than at 03:00.