Scenario 05 / 10 · NIST SP 800-61 REV. 3

Suspicious data export

A staff account exports a large customer dataset outside its normal schedule; the account owner says the task may be authorized.

Fictional training scenario; no real system or person is described.

Safety and authority boundary

Preserve privacy and employment due process; an account label is not proof of a person's intent.

01 / 05

Preparation

GV · ID · PR

A staff account exports a large customer dataset outside its normal schedule; the account owner says the task may be authorized.

Your decision. Before opening the response, decide what each named team should do, how it would do it, why, whose approval is needed, and what evidence would change the decision.

Reveal the worked team response

Team	What	How	Why
Maple Evidence team	Prepared an evidence route	Named read-only sources and custodians for: Audit records show the export job and destination identifier but not who initiated it or whether the recipient downloaded it.	The first alert needs a verifiable provenance and time.
Nimbus Service team	Rehearsed safe continuity	Tested an isolated version of: Restore authorized reporting from a scoped dataset after confirming purpose, destination and access rights.	A rushed recovery can worsen the service impact.
Orion Decision team	Set authority and escalation	Assigned owners and approval conditions around: Preserve privacy and employment due process; an account label is not proof of a person's intent.	Safety, privacy and communications need accountable decisions.

02 / 05

Detection and analysis

Audit records show the export job and destination identifier but not who initiated it or whether the recipient downloaded it.

Your decision. Before opening the response, decide what each named team should do, how it would do it, why, whose approval is needed, and what evidence would change the decision.

Reveal the worked team response

Team	What	How	Why
Maple Evidence team	Triaged the signal	Preserved source, UTC time and a second independent check for: Audit records show the export job and destination identifier but not who initiated it or whether the recipient downloaded it.	One alert is a lead, not proof of cause or scope.
Nimbus Service team	Measured user impact	Compared the actual service with the scenario baseline: A staff account exports a large customer dataset outside its normal schedule; the account owner says the task may be authorized.	Technical alerts alone do not establish operational impact.
Orion Decision team	Declared a bounded case	Recorded confirmed facts, unknowns, owner and next review time.	The teams can coordinate without overstating the evidence.

03 / 05

Response and containment

Preserve privacy and employment due process; an account label is not proof of a person's intent.

Your decision. Before opening the response, decide what each named team should do, how it would do it, why, whose approval is needed, and what evidence would change the decision.

Reveal the worked team response

Team	What	How	Why
Maple Evidence team	Preserved and scoped evidence	Saved the original records and defined a bounded path for: Pause the scheduled export with data-owner approval and preserve the minimum audit and access records needed.	Containment must not destroy the basis for later review.
Nimbus Service team	Applied the approved control	Implemented: Pause the scheduled export with data-owner approval and preserve the minimum audit and access records needed.	A reversible, owner-approved change reduces harm without expanding scope.
Orion Decision team	Authorized and communicated	Logged the approver, affected users and constraint: Preserve privacy and employment due process; an account label is not proof of a person's intent.	Response actions need clear authority and proportional notice.

04 / 05

Recovery

Restore authorized reporting from a scoped dataset after confirming purpose, destination and access rights.

Your decision. Before opening the response, decide what each named team should do, how it would do it, why, whose approval is needed, and what evidence would change the decision.

Reveal the worked team response

Team	What	How	Why
Maple Evidence team	Checked for persistence	Compared new telemetry against: The data owner confirms the permitted extract; logs show no further unauthorized export and access review is complete.	An apparently healthy service can still be compromised.
Nimbus Service team	Restored in stages	Executed: Restore authorized reporting from a scoped dataset after confirming purpose, destination and access rights.	A staged return tests dependencies before widening access.
Orion Decision team	Accepted the business outcome	Requested owner sign-off only after: The data owner confirms the permitted extract; logs show no further unauthorized export and access review is complete.	Recovery is a service decision, not merely a green dashboard.

05 / 05

Improvement

ID.IM

Record export approvals, minimum fields, retention and independent privacy review.

Your decision. Before opening the response, decide what each named team should do, how it would do it, why, whose approval is needed, and what evidence would change the decision.

Reveal the worked team response

Team	What	How	Why
Maple Evidence team	Turned uncertainty into a test	Documented the evidence gap and proposed: Record export approvals, minimum fields, retention and independent privacy review.	A lesson needs a measurable future check.
Nimbus Service team	Rehearsed the changed control	Assigned an owner and date to test: Record export approvals, minimum fields, retention and independent privacy review.	An untested action item is not a verified improvement.
Orion Decision team	Closed the decision record	Approved resources, tracked the owner and checked the new control later.	Learning must feed Govern, Identify and Protect.

Recovery acceptance test

The data owner confirms the permitted extract; logs show no further unauthorized export and access review is complete.

Improvement to verify

Record export approvals, minimum fields, retention and independent privacy review.