# Breach Simulation Exercise Design Workflow

## Phase 1: Planning (4-6 Weeks Before Exercise)

1. **Define objectives**: What specific aspects of the breach response plan are being tested? (e.g., Art. 33 notification process, executive decision-making, cross-functional communication).
2. **Select scenario type**: Choose from ransomware, insider threat, processor breach, or other scenario based on organizational risk profile and previous exercise findings.
3. **Identify participants**: Select 8-15 participants representing all key functions (see participant roles matrix).
4. **Schedule**: Book 3-4 hours including setup, exercise, and debrief. Schedule at least 4 weeks in advance to ensure executive availability.
5. **Assign facilitator**: External facilitator preferred for objectivity; internal audit acceptable for routine exercises.
6. **Prepare logistics**: Book conference room, prepare printed materials, set up communication tools if testing communication channels.

## Phase 2: Scenario Development (3-4 Weeks Before)

1. **Write the scenario narrative**: Create a realistic scenario based on actual breach trends (Verizon DBIR, EDPB breach examples, recent enforcement actions).
2. **Develop inject timeline**: Create 6-8 injects spaced 15-20 minutes apart, each introducing new information or complications.
3. **Identify decision points**: For each inject, define the key decision(s) participants should make and the "ideal" response per the breach response plan.
4. **Prepare supporting materials**: Create mock SIEM alerts, sample forensic findings, mock media articles, and mock customer complaints.
5. **Review with DPO and CISO**: Ensure the scenario is realistic and tests meaningful aspects of the response plan without being so complex that it derails discussion.

## Phase 3: Pre-Exercise Preparation (1 Week Before)

1. **Distribute background briefing**: Send participants a 1-page briefing setting the organizational context (company profile, data processing activities, key contacts). Do NOT reveal the scenario.
2. **Confirm attendance**: Verify all assigned participants are available. Identify alternates if needed.
3. **Facilitator preparation**: Brief the facilitator on exercise objectives, inject timing, and areas of particular focus.
4. **Observer briefing**: Brief the observer/recorder on what to document (decisions made, time taken, communication patterns, gaps identified).

## Phase 4: Exercise Execution (Exercise Day)

1. **Opening (15 minutes)**: Facilitator introduces the exercise, explains ground rules (no cell phones, Chatham House Rule for discussion, no "right answers" — this is a learning exercise, not a test).
2. **Scenario delivery (2.5-3 hours)**: Deliver injects per the timeline. After each inject, facilitate discussion: "What would you do? Who needs to be informed? What information do you need?"
3. **Decision capture**: Observer records each decision, who made it, the rationale, and the time taken.
4. **Debrief (30-45 minutes)**: Facilitator leads a structured debrief: "What went well? What was challenging? What would you do differently? What gaps did we identify?"

## Phase 5: After-Action Report (1-2 Weeks After)

1. Compile the observer's notes into a structured after-action report.
2. Identify findings categorized by severity (Critical, Major, Minor, Observation).
3. For each finding, provide a specific recommendation with an owner and target date.
4. Present the after-action report to the DPO, CISO, and CEO.
5. Track remediation of findings to completion.
6. Use findings to update the breach response plan and inform the next exercise scenario.