Fly Rejects Breach Post Mortem, Escalates Phishing to Board

Decisions 4 today

The business responds

• OT / Grid Operations heard that the fly wanted more information on “Network segmentation between corporate IT and grid OT” and refused, loudly enough to be heard two floors down. Their opinion of the fly took a real knock.

  “We have a public breach and the ruling is eye-cleaning adjacent. Send the scoped review plan today, or stop calling this a decision.”

  OT / Grid Operations Pushed back trust -8

  Next, they want: “Today: affected assets, evidence sources, named reviewers, a decision deadline, no production changes, and Grid Operations approval before any action or escalation.” They have already asked for a slot in the fly's diary.

• Legal / Compliance heard that the fly threw out “Public data breach: post mortem” and refused, loudly enough to be heard two floors down. Their opinion of the fly took a real knock.

  “Rejecting a post mortem because the escape circuit fired is not a closure decision. It is a regulator’s exhibit, neatly labeled.”

  Legal / Compliance Pushed back trust -8

  Next, they want: “By end of day, provide the written post-mortem decision record, preservation confirmation, corrective-action owner list, and counsel-reviewed notification assessment.” Expect an email.

• Executive Board heard that the fly threw out “Public data breach: post mortem” and refused, loudly enough to be heard two floors down. Their opinion of the fly took a real knock.

  “Rejecting the post mortem is impressive in the way declining a calendar invite does not repair billing, customers or the share price.”

  Executive Board Pushed back trust -6

  Next, they want: “Within one hour, provide the final incident timeline, verified customer-impact range, root-cause owner, costed remediation plan, counsel's disclosure position, and the board closeout time.” Expect an email.

• When the fly sent “Phishing wave: A wave of credential-harvesting mail is hitting staff inboxes” up to the board, IT / Infrastructure dug in its heels. Their opinion of the fly took a real knock.

  “Excellent, the board has been alerted. The inboxes remain very impressed by this.”

  IT / Infrastructure Pushed back trust -6

  Next, they want: “Authorize immediate staff warning and mailbox containment, with a 30-minute review hold limited to operational impact, dependencies, and disclosure phasing.” Expect an email.

• When the fly threw out “Public data breach: post mortem”, International Communications dug in its heels. Their opinion of the fly took a real knock.

  “Rejecting the post mortem is an elegant way to ensure the press writes one for us, with adjectives.”

  International Communications Pushed back trust -8

  Next, they want: “Approve a public remediation update, named spokesperson and next briefing time within two hours.” Expect an email.

Diary

• OT / Grid Operations: “Send today a narrowly scoped impact-review plan: affected assets, named reviewers, evidence sources, no production changes, and Grid Operations approval before any action or escalation.” Meeting · dropped

  Back on day 10, OT / Grid Operations asked for a meeting with the fly about “Send today a narrowly scoped impact-review plan: affected assets, named reviewers, evidence sources, no production changes, and Grid Operations approval before any action or escalation”. It was postponed once, and today it quietly vanished from the calendar. Nobody has asked where it went.

• OT / Grid Operations: “Send the narrowly scoped audit review plan today, including affected assets, evidence sources, named reviewers, and confirmation that Grid Operations approves any action or escalation.” One-to-one · dropped

  Back on day 12, OT / Grid Operations asked for a one-to-one with the fly about “Send the narrowly scoped audit review plan today, including affected assets, evidence sources, named reviewers, and confirmation that Grid Operations approves any action or escalation”. It was postponed once, and today it quietly vanished from the calendar. Nobody has asked where it went.

• Audit evidence checkpoint Audit checkpoint · dropped

  Back on day 13, Legal / Compliance, OT / Grid Operations and Finance asked for an audit checkpoint. It was postponed once, and today it quietly vanished from the calendar. Nobody has asked where it went.

• Audit evidence checkpoint Audit checkpoint · postponed

  Back on day 14, Legal / Compliance, OT / Grid Operations and Finance asked for an audit checkpoint. It was due today, and got pushed back over a diary clash nobody will explain.

• Public data breach: incident war-room War room · dropped

  Back on day 15, International Communications, Legal / Compliance and Executive Board asked for an incident war-room. It was postponed once, and today it quietly vanished from the calendar. Nobody has asked where it went.

• Legal / Compliance: “Immediately provide the written decision record, preservation notice, and counsel-reviewed notification assessment, including the basis for rejecting disclosure.” Meeting · dropped

  Back on day 15, Legal / Compliance asked for a meeting with the fly about “Immediately provide the written decision record, preservation notice, and counsel-reviewed notification assessment, including the basis for rejecting disclosure”. It was postponed once, and today it quietly vanished from the calendar. Nobody has asked where it went.

• Public data breach: incident war-room War room · dropped

  Back on day 16, International Communications, Legal / Compliance and Executive Board asked for an incident war-room. It was postponed once, and today it quietly vanished from the calendar. Nobody has asked where it went.

• OT / Grid Operations: “Today: affected assets, named reviewers, evidence sources, no production changes, and Grid Operations approval before any action or escalation.” One-to-one · postponed

  Back on day 16, OT / Grid Operations asked for a one-to-one with the fly about “Today: affected assets, named reviewers, evidence sources, no production changes, and Grid Operations approval before any action or escalation”. It was due today, and got pushed back over a diary clash nobody will explain.

• Public data breach: incident war-room War room · postponed

  Only yesterday, International Communications, Legal / Compliance and Executive Board asked for an incident war-room. It was due today, and got pushed back over a diary clash nobody will explain.

What each department thinks of the fly