Rehearsal: the breach runbook gets a quarterly tabletop drill, and the contact sheet (APDP,
lawyer, provider DPO contacts) is kept current as part of it.
Runbooks
Each runbook must be executable, step by step, by a person with no prior context — that is the acceptance criterion, not thoroughness.
⌘I