EXERCISE PURPOSE
Assess and improve enterprise resilience to a major cyber incident affecting an information-technology company and its customers.
Malware introduced through a third-party application and propagated to customers in a software update
← Exercise library
Stock photography via UnsplashCISA.GOV CTEP · SOFTWARE & SUPPLY CHAIN
CISA Information Technology Sector
An employee installs a compromised application, attackers enter the development environment, and the organization unknowingly ships malware to customers. Data theft, financial manipulation, internal encryption, lawsuits, and media scrutiny follow.
3 HRSuggested duration11Participant roles9Scenario stages
DECISION PRESSURE
Questions the team must answer together
The facilitator releases facts in stages. Participants should identify the decision owner, the authority being used, the information still needed, the immediate action, and the next escalation point.
What can reach build, signing, and release systems?
Can the organization identify every customer and artifact receiving a compromised build?
Who can suspend distribution and direct customers to disconnect?
How are internal response and customer incident support coordinated?
What proof is required before a corrected release is trusted?
INSIDE THE EXERCISE
A scenario that changes as the response develops
The template is already populated with public injects, facilitator-only context, discussion prompts, private role messages, and a final hotwash.
- Day 1Module 1
IT-sector supply-chain alert
CISA warns that state-sponsored actors are targeting software and firmware companies and their customers, compromising products to gain access to critical-infrastructure networks.
- Day 12Module 1
Developer downloads third-party application
A software-development employee downloads an application from an official third-party vendor website and installs it successfully.
- Day 20Module 1
Software update released to customers
The organization publishes a software update and urges customers to install it promptly.
- Day 30Module 1
Outbound traffic to foreign address
An employee detects a high volume of data leaving organizational servers for an unauthorized IP address in a foreign country.
- Day 31 · MorningModule 2
Customers report exfiltration and financial manipulation
Customers using the new release report large unauthorized transfers. Some also report altered financial data and redirected bank payments. Every known victim installed the recent update.
- Day 31 · AfternoonModule 2
Internal systems encrypted
Investigators discover that core databases, files, and programs are encrypted. Operations stop, developers cannot work, and support teams cannot troubleshoot customer reports.
- Day 33Module 2
Customers threaten suit; reporters call
Customers threaten legal action over sensitive-data loss and reporters ask the organization to comment.
PARTICIPANTS
Bring the decision-makers who would own the real event
Assign people to functions, not titles alone. If one person owns several functions, keep the roles distinct during discussion so conflicts and handoffs remain visible.
Incident CommanderChief Information Security OfficerIT Operations LeadSecure Software Development LeadProduct Security or PSIRT LeadGeneral CounselCustomer Success LeadCommunications LeadThird-Party Risk LeadBusiness Continuity LeadExecutive Sponsor
REAL-WORLD INCIDENTS
Ground the exercise in events teams can recognize
Use these cases during planning or the prebrief. They are factual anchors, not scripts. Adapt the scenario to the organization’s technology, industry, geography, contracts, regulators, and risk profile.
SolarWinds Orion compromise↗
CISA directed federal agencies to disconnect affected Orion products after malicious code was distributed through trusted software updates.
3CX DesktopApp compromise↗A trojanized communications application enabled multi-stage downstream compromise.
MOVEit exploitation↗Mass exploitation of internet-facing file-transfer software drove widespread customer, notice, and vendor-coordination work.
LEGAL, REGULATORY & STANDARDS LENS
Authorities worth testing against the scenario
Applicability depends on the organization and facts. Use counsel and subject-matter owners to tailor deadlines, thresholds, privileges, preservation, reporting, and communications.
CISA Cybersecurity Scenarios↗
The source collection for CISA Tabletop Exercise Packages covering ransomware, insider threats, phishing, supply-chain compromise, and sector incidents.
SEC cybersecurity incident disclosure rules↗Public companies must assess materiality and disclose material incidents on Form 8-K Item 1.05 within four business days after the materiality determination, subject to the rule’s limited delay process.
NIST SP 800-161 Rev. 1 Update 1↗Test software-supply-chain governance, critical suppliers, provenance, monitoring, response, and recovery.
PRACTITIONER PERSPECTIVES
Law-firm and security-professional guidance
External perspectives help the design team challenge internal assumptions. They do not replace organization-specific legal or technical advice.
EXPECTED OUTPUT
Finish with an improvement plan, not a score.
- Secure-development escalation criteria
- Build and release containment decisions
- Customer identification and support procedures
- Legal and disclosure workstreams
- A trust-restoration and corrective-release plan