A breach tabletop drill shows unclear ownership for external communications and evidence preservation. What should governance strengthen with security and legal?
Select an answer to reveal the explanation.
Short Explanation
Drills that end with “who calls whom?” are doing you a favor—fix it now. Pre-name who speaks externally and who preserves evidence so the real night is not a scramble.
Full Explanation
A breach tabletop that reveals unclear ownership for external communications and evidence preservation means governance should strengthen pre-defined roles across data governance, security, and legal before a real event. Civic incidents demand rehearsed lanes for public statements and forensic integrity. Leaving incident roles undefined to preserve flexibility under stress fails because stress amplifies confusion without a playbook. Assigning every incident task solely to the marketing content team fails by misplacing technical evidence and legal duties with messaging staff. Documenting roles only after the next real breach concludes fails by learning exclusively through resident-harming failure. Exam caveat: tabletop findings should drive RACI updates—exams expect proactive role definition for communications and evidence. Operational check: update the incident RACI with named primaries and backups for external communications and evidence preservation, rerun a short drill, and store contact trees with the municipal incident plan. Confirm legal and security concur so DG is not improvising alone when city systems are compromised. Keep verification evidence with the municipal runbook so audits can prove the chosen control was applied as designed and that rejected alternatives would have left city services exposed to the failure modes described above.