3 findings from the last exercise
Every one became a gap in the register. The most consequential was that impact assessment took six hours against a two-hour target — a discovery coverage problem that would have consumed most of the 72-hour window on a real incident.
Exercises
3
Completed
1
Scheduled
2
Average score
72%
Exercises
H1 FY2026-27 breach simulationcompleted
Compromised service account extracts 150,000 citizen records overnight; detection at 03:00; Board clock starts immediately.
72%
Held
02 May 2026
Participants
18
Facilitator
Sentinel SOC Partners
Completed
3 months ago
Findings
- Impact assessment took 6 hours; target is 2. Discovery coverage of the warehouse was the bottleneck.
- No pre-approved Data Principal notification template existed in Hindi.
- Escalation to the Principal Secretary was delayed by an out-of-date contact list.
Each finding was raised as a gap and is tracked in the remediation roadmap.
Processor-reported breach exercisescheduled
A processor reports a breach 40 hours after becoming aware, leaving 32 hours on the Board clock.
Scheduled for
09 September 2026
Participants
14
Facilitator
Meera Iyer
In
next month
14 participants invited
Children's data exposure exercisescheduled
Public exposure of scholarship records affecting 9,800 children; media attention within 4 hours.
Scheduled for
17 October 2026
Participants
16
Facilitator
Sentinel SOC Partners
In
in 2 months
16 participants invited
What a good exercise tests
Not whether people know the plan exists, but whether the plan survives contact with a clock.
- How long impact assessment actually takesThe gap between the target and the reality is almost always a discovery coverage problem.
- Whether notification templates exist in the right languagesDrafting a bilingual Data Principal notification under time pressure produces bad copy.
- Whether the escalation list is currentThe most common failure, and the easiest to fix in advance.
- Who is authorised to file with the BoardIf that authority is ambiguous, the 72-hour deadline becomes a negotiation.
- What happens when a processor reports lateTheir notification starts your clock, which may already be 40 hours old.
- Whether containment and evidence preservation conflictThey often do, and the decision should be made in advance rather than at 03:00.