Your data leaked from a vendor's cloud: which exercise to run, a tabletop or a functional exercise?
Quick answer, Nov 13, 2026As of 13 November 2026, start with a facilitated tabletop, not a functional exercise. NIST SP 800-84 puts training and tabletops first. For the scenario, use TSMC's 12 November Form 6-K. Its employee data turned up on an external website and matched a cloud provider's system. TSMC found no evidence its own systems were compromised.
The scenario, in the filing's own words
Most breach exercises start inside your own network. This one does not. On 12 November 2026, Taiwan Semiconductor Manufacturing Company furnished a Form 6-K titled "Statement Regarding the Unauthorized Access of Employee Personal Data". It says "some of our current and former employee data was made available on an external website without authorization". It also says "we have found no evidence that TSMC's systems have been compromised", and that the data "has been verified to match data stored in the system services of a cloud service provider". It has engaged "the cloud service vendor, the relevant investigating authorities, and a third-party cybersecurity agency".
The provider and how the data left are not in the filing, so both are UNKNOWN. The shape is usable: you find the data first, the vendor's system holds it, and your own logs show nothing.
Why a vendor's system doesn't let you off the hook
The SEC declined to exempt incidents on third-party systems. Its adopting release (Release No. 33-11216, section II.A.3, "Final Amendments") says "whether an incident is material is not contingent on where the relevant electronic systems reside or who owns them". It also says disclosure "may be required by both the service provider and the customer, or by one but not the other, or by neither", and that registrants "should disclose based on the information available to them."
The clock is in Form 8-K. Instruction 1 to Item 1.05 requires the materiality determination "without unreasonable delay after discovery of the incident". General Instruction B.1 then sets the filing deadline at "four business days after the registrant determines that it has experienced a material cybersecurity incident". For foreign private issuers, Form 6-K General Instruction B lists "material cybersecurity incident" among the matters on which an issuer must furnish information it makes public.
NIST puts the vendor into practice. CSF 2.0 ID.IM-02 covers improvements from exercises "including those done in coordination with suppliers and relevant third parties". In SP 800-161r1-upd1, Appendix A, the supplemental guidance to IR-3 "Incident Response Testing" says critical suppliers should be "included in and/or provided with incident response testing."
Which exercise to buy
| Option | What you get | Planning time the source gives | Where it is written |
|---|---|---|---|
| 1. Training session | Participants learn their roles in the plan before anyone is tested on them | Not stated. NIST says "training sessions typically precede exercises and tests" | NIST SP 800-84, section 3 "Training Sessions" |
| 2. Self-run tabletop | Packaged scenarios and discussion questions, CISA templates for planners, facilitators and evaluators, and an After Action Report. You adapt a scenario to the vendor side | Not stated | CISA Tabletop Exercise Packages, "Cybersecurity Scenarios" and "CTEP Documents" |
| 3. Facilitated tabletop | A discussion-based session, "typically two to eight hours", with a facilitator guiding the discussion toward "pre-defined objectives" | At least one month ahead for less complex exercises, at least three months for large ones | SP 800-84, section 4 and section 4.2 "Design the Tabletop Exercise Event" |
| 4. Functional exercise | Staff carry out their duties in a simulated operational environment, over "several hours to several days" | "At least a few months" | SP 800-84, section 5 and section 5.2 "Design the Functional Exercise Event" |
| 5. CISA-supported exercise | CISA provides planning meetings, document and scenario development, facilitation and after-action report development | Tabletop 3–4 months, functional 6–12 months, full-scale 12–24 months | CISA Exercise Planning and Conduct Support Services, "Types of Exercises" |
Start with the tabletop
SP 800-84 section 5.1, "Evaluate the Need for a Functional Exercise and Create a Schedule", says "it is usually best to ensure adequate staff training and tabletop exercises have taken place before engaging in a functional exercise." A footnote to section 4.1 notes that some organizations combine a tabletop "with a training session that immediately precedes" it: options 1 and 3 back to back.
Under "Cybersecurity Scenarios", the CISA package page names the vectors its cyber scenarios include: "ransomware, insider threats, phishing, and Industrial Control System (ICS) compromise". A provider-side exposure is not on that list; the support service's "Example Exercise Scenarios" entry "Loss of Personally Identifiable Information (PII)" is the closest. Plan to write the vendor-side part yourself.
The functional exercise comes next, and someone has to play the vendor. Section 5.2.5, "Identify the Functional Exercise Staff", provides for simulators, "who simulate or otherwise represent non-participating individuals and organizations whose input is necessary to the flow of the exercise."
Five injects for the room
- Discovery. Your staff records surface on an external site; your logs show nothing. Who owns the first hour?
- Matching. Who can confirm the records match a vendor-held system, and through which contractual channel? The SEC release (section II.A.3) says the rules generally do not require inquiries "outside of their regular channels of communication with third-party service providers pursuant to those contracts".
- Materiality. Who makes the materiality determination, and how do you prove it came "without unreasonable delay" (Form 8-K, Instruction 1 to Item 1.05)?
- People. Who tells current and former employees, and with what support? TSMC says it is "informing impacted personnel and are providing them with necessary support."
- Outside help. Which forensics firm and which authorities do you call, and is that in the plan?
Before you book a facilitator
Ask four things. Will they write the scenario around your actual providers? Can they run senior and operational rooms separately? Who plays the vendor? What does the after action report track?
Design steps: tabletop exercise for an AI agent outside its permissions. Running and scoring the room: training staff to spot deepfake impersonation. The contract side: third-party risk after a provider-led breach.
An AI assistant can list 8-K Item 1.05 and 8.01 filings with list_cyber_incident_filings on the Distributed Risk MCP server; how to read them. A 6-K like TSMC's is not in that list; read it on EDGAR. For a facilitator, an exercise built around your vendors, or a response firm on retainer, brief an advisor and we arrange a partner firm.
Questions
We aren't an SEC registrant. Does this apply? The Item 1.05 clock doesn't. The scenario still does, and CSF 2.0 says in its Preface that it is "designed to help organizations of all sizes and sectors".
Will an exercise make us compliant? No exercise guarantees that. SP 800-84 section 5.2.3, "Identify the Objectives", sets the objective as validating the plan, the roles and the interdependencies it documents. You get a list of gaps; closing them is a separate decision.
Is this legal advice? No. This page is a procedural guide drawn from the public record. Counsel decides what your disclosure and notification obligations are.