CISA.GOV CTEP · INSIDER RISK
A known hardware vulnerability, an accidental PII disclosure, and a hostile termination converge when the former employee joins a vendor and an attacker uses an unauthorized administrator account to destroy critical files.
EXERCISE PURPOSE
Malicious and unintentional insiders exploiting technical, personnel, and supply-chain weaknesses
DECISION PRESSURE
The facilitator releases facts in stages. Participants should identify the decision owner, the authority being used, the information still needed, the immediate action, and the next escalation point.
Who combines HR, physical-security, vendor, and cyber signals?
What monitoring is lawful, proportionate, documented, and technically useful?
When can access be limited before the facts are complete?
How will the team preserve evidence without alerting a suspected actor?
Who decides whether to notify individuals, customers, insurers, or law enforcement?
INSIDE THE EXERCISE
The template is already populated with public injects, facilitator-only context, discussion prompts, private role messages, and a final hotwash.
CISA releases information about frequently exploited CVEs. IT identifies a vulnerability in widely deployed microprocessors that may expose sensitive data.
IT determines that the vulnerable microprocessors must be replaced. Cost and operational constraints produce a year-long replacement strategy.
An employee inadvertently emails PII belonging to the organization, customers, or clients to several external contacts.
During a meeting about the disclosure, a highly competent employee loudly berates a colleague. HR previously warned that another incident would result in termination.
Senior management terminates the employee for misconduct. The employee reacts angrily and warns management, “You will be sorry.”
Replacement begins, but high demand for hardware extends the projected completion time from one year to 18 months.
A key vendor reveals that it hired the terminated employee and promises that the person will not attend meetings with the organization.
PARTICIPANTS
Assign people to functions, not titles alone. If one person owns several functions, keep the roles distinct during discussion so conflicts and handoffs remain visible.
REAL-WORLD INCIDENTS
Use these cases during planning or the prebrief. They are factual anchors, not scripts. Adapt the scenario to the organization’s technology, industry, geography, contracts, regulators, and risk profile.
Block reported that a former employee accessed customer reports without permission after employment ended, affecting approximately 8.2 million current and former customers.
DOJ Google AI trade-secret case↗The indictment alleged that an employee transferred sensitive AI trade secrets to a personal account while secretly affiliating with outside companies.
LEGAL, REGULATORY & STANDARDS LENS
Applicability depends on the organization and facts. Use counsel and subject-matter owners to tailor deadlines, thresholds, privileges, preservation, reporting, and communications.
The source collection for CISA Tabletop Exercise Packages covering ransomware, insider threats, phishing, supply-chain compromise, and sector incidents.
DOJ trade-secret protection discussion↗Useful context for decisions about involving prosecutors while protecting sensitive trade-secret evidence.
CISA Insider Threat Mitigation Guide↗A framework for defining, detecting, assessing, and managing insider risk.
PRACTITIONER PERSPECTIVES
External perspectives help the design team challenge internal assumptions. They do not replace organization-specific legal or technical advice.
Practitioner context spanning inside actors, investigations, incident response, and enterprise risk.
CrowdStrike tabletop exercise guidance↗Security-practitioner guidance emphasizing realistic injects, tailored scenarios, decision-making, communications, and coordination.
EXPECTED OUTPUT