Incident Response
IR-08Run a tabletop exercise each year and fold the findings into the plan
How Leela would run itAnnual · once a year, with the plan update that follows; sooner on material change
From the policy libraryThe requirement
The Company tests this plan with a tabletop exercise at least once a year, on a scenario prepared in advance such as a payment outage, a customer data breach, or a vendor compromise. The response team walks through the response as the facilitator introduces new facts, the facilitator documents observations and improvement areas, and the findings are carried into the next plan update. The plan itself is reviewed at least annually and sooner on a material change to systems, vendors, requirements, or the threat landscape.
- Applies
- Tell Leela about your company to see whether this applies.
- Status
- Setup needed
Tell Leela how you handle it today, or hand it over: see what’s next.
The work
Prepare the scenario, run the exercise with the response team, document the observations, update the plan, and distribute the approved version to staff and the sponsor bank.
What Leela keepsThe evidence this obligation leaves, as the work happens
Listed from the policy libraryContents
- 01Tabletop exercise reportScenario, participants, date, observations, improvement areas
- 02Plan revision recordVersion, changes made, approver, date distributed
Evidence
Tabletop exercise report
Incident Response §9, §11
2
of 2 records
The work and the records come from this obligation in the policy library.