How Breach Inc. maps to cyber security standards
Last reviewed 20 October 2026. We review this page every year, and whenever one of these standards changes.
Contents
- How to read this
- Summary
- UK
- International
- What Breach Inc. doesn't cover
- Sources
How to read this
Breach Inc. has been internally assessed against a number of standards and regulator expectations, relating to board-level education, incident response exercise and governance principles. The results are outlined below; organisations should undertake their own review of coverage if Breach Inc. is to be used to demonstrate compliance.
Breach Inc. supports the incident response parts of these standards strongly and their wider governance parts only lightly. It rehearses how a leadership team responds to a major data breach. It does not assess, measure or improve an organisation's defences.
Breach Inc. is a 35 minute interactive story in which players lead the response to a major data breach. It ends with 11 lessons and 29 questions for the leadership team. The lessons are:
- Foundations, automation and rehearsal
- Who's read in, and who they can talk to
- Scope, and the number
- Leadership: one channel, and clear decision-makers
- Insider risk
- Decisions only the board can make
- A public response people can trust
- Help on contract before you need it
- Someone has to make rest happen
- Tell your own people first
- The crisis doesn't end at the announcement
Organisation licences add a facilitated session deck with notes for each pause point. The mapping below covers the game and the session together.
Each mapping uses four levels:
| Level | Meaning |
|---|---|
| Strong | Breach Inc. rehearses the requirement directly and generates questions that test it. |
| Partial | Breach Inc. covers part of the requirement, or raises it without testing it. |
| Light | Breach Inc. touches on the topic in passing. It is not evidence of meeting it. |
| Not covered | Out of scope. Use another resource. |
No game or workshop makes an organisation compliant with any of these standards. Breach Inc. is evidence of awareness, training and exercising, which several of them ask for.
Summary
| Standard | Strongest match | Overall depth | In one line |
|---|---|---|---|
| NCSC Cyber Security Toolkit for Boards | Planning your response to cyber incidents | Strong for 1 of 10 modules, partial for 6 | A hands-on companion to the incident response module |
| UK Cyber Governance Code of Practice | D2 exercising, D3 decisions and communications in an incident, C3 director training | Strong for Principle D, little for A, B and E | Evidence of annual exercising and director training |
| NCSC Cyber Assessment Framework | D1.c testing and exercising | Partial | One exercise among several; needs your own scenarios over time |
| NHS DSPT (CAF-aligned) | D1.c, which lists tabletop exercises and data breach scenarios | Partial, with a strong fit for D1.c | Tests plan contents the DSPT asks for: backups for key roles, pre-agreed supplier help, regulatory reporting |
| ISO/IEC 27001:2022 | 5.24 incident preparation, 5.5 contact with authorities, 6.3 awareness | Partial | Supporting evidence for an audit, not a control in itself |
| UK GDPR breach reporting | Article 34, telling the people affected | Partial | Rehearses the decisions, not the legal tests |
| NACD Director's Handbook (US) | Tool B, the board's role in incident response | Strong for Tool B, light for the principles | The tabletop exercise the handbook recommends |
| WEF Principles for Board Governance | Principle 3, tested plans | Light | Little overlap; see NACD instead |
NCSC Cyber Security Toolkit for Boards
Breach Inc. covers one of the toolkit's ten modules strongly: Planning your response to cyber incidents. It covers six more in part and touches the rest lightly. The toolkit is mostly about governance before an incident, and Breach Inc. is about leading during one. The two work well together: the toolkit sets the questions, and Breach Inc. makes a board feel why they matter.
Mapped against the toolkit's Questions for the board to ask about cyber security (version 3.0, reviewed April 2025).
| Toolkit module | Depth | Where Breach Inc. covers it | What it doesn't cover |
|---|---|---|---|
| Planning your response to cyber incidents | Strong | Questions 1, 2 and 5 (plan and exercise it, each board member's role, where to go for help): lessons 1, 4, 6 and 8 rehearse decisions under time pressure, a CEO statement agreed in advance, contacting the regulator, police and national cyber agency, and help on contract. Lesson 6 and the session deck add cyber insurers to the outsiders to tell; the deck notes that policies often need notice quickly. Question 3 (improvements after an incident): lesson 11 asks how the team would review a breach without blame, and make sure the lessons change plans and the next exercise. | Question 4, business continuity and disaster recovery. The scenario is data theft, so systems stay up; there is no outage to recover from. |
| Implementing effective cyber security measures | Partial | Question 1 (security metrics shared with the board): the session deck asks the board which metrics would show that foundational controls (asset management, patching, logging and monitoring) are working, with examples in the notes, and lesson 1 asks which measures would show those foundations are working. Lesson 1 also asks which hardening steps could be automated now, such as credential rotation. | Posture reviews, tracing measures to risks, rolling measures out with the workforce. |
| Growing cyber security expertise | Partial | Question 3 (keeping people in key roles): lessons 9 and 11, on burnout, single points of failure and who stays afterwards. Question 6 (board knowledge to decide): the game as a whole, and lesson 6 on advisers who have done it before. | Skills gap reviews, hygiene metrics, diversity. |
| Identifying the critical assets | Partial | Questions 1 and 3 (a complete inventory, with an owner for each asset): lesson 1 asks how long it would take to list every internet-facing system and its owner. | Linking assets to business objectives; keeping the baseline up to date. |
| Developing a positive cyber security culture | Partial | Lessons 9, 10 and 11 cover culture under strain: rest, telling staff first, accepting risk again afterwards. Question 3 (a no-blame culture): lesson 11 asks how the team would review a breach without looking for someone to blame. | Leading by example, success-based metrics. |
| Collaborating with your supply chain | Partial | Question 2 (exercises with suppliers): lesson 1 asks whether rehearsals include key suppliers. Lesson 8 treats suppliers as surge help (call handlers, analysts) that should be contracted before an incident. | Suppliers as a route in for attackers, supplier assurance and metrics. |
| Embedding cyber security into your organisation | Light | The story shows Legal, communications, HR and the board all pulled into a breach, which supports question 3 (cyber security in every business unit's priorities). | External risk assessment, cyber strategy, board reporting. |
| Understanding the cyber security threat | Light | One scenario: theft of customer data. The session deck adds ransomware and supply chain examples (Ireland's HSE, NotPetya). | Threat assessment, sector information sharing. |
| Risk management for cyber security | Partial | Question 4 (which risks the board would accept): lesson 8 asks whether we could cope with a breach in our busiest week or alongside another crisis, and which disruptions the board has agreed it could accept. Each choice in the game is a trade-off, which shows risk being accepted under pressure. | Risk registers, integrating cyber risk with business risk. |
| Introduction to cyber security for board members | Light | It shows why a breach is a board-level issue. | Basic cyber security concepts. |
UK Cyber Governance Code of Practice
Breach Inc. supports Principle D (incident planning, response and recovery) strongly, and director training under Principle C. It does little for Principles A, B and E, which cover risk, strategy and oversight. The code was published by the government on 8 April 2025, and the NCSC Board Toolkit is organised around it.
| Code action | Depth | How Breach Inc. supports it |
|---|---|---|
| D2: exercise the plan at least once a year, with internal and external stakeholders | Strong, with limits | A Breach Inc. session is a leadership exercise, and the facilitator guide includes a board briefing format. It is a generic scenario, so it tests judgement more than your own plan. An organisation licence lets you adapt it to your policies and processes. It doesn't involve external stakeholders unless you invite them, and lesson 1 asks whether your rehearsals include key suppliers. |
| D3: in an incident, take responsibility for regulatory obligations, and support critical decisions and external communications | Strong | Lessons 3, 6, 7 and 10: signing off and revising the number affected, contacting regulators, the CEO's statement, the public response, and staff and media communications. |
| D1: a plan to respond to and recover from an incident | Partial | The 29 questions test whether a plan covers who's read in, deputies, approval of spending, surge capacity and communications. Recovery of systems isn't covered. |
| D4: post-incident review, with lessons fed back | Partial | Lesson 11 asks how the team would review a breach without blame, and make sure the lessons change the plan and the next exercise. It doesn't cover how to run the review. |
| C3: directors train to improve their own cyber literacy | Strong | A board playing Breach Inc. is director-level training. With an organisation licence, completions are recorded in a learning platform. |
| C4: an effective training and awareness programme, measured by suitable metrics | Partial | Records completions through the learning platform package. It measures that people completed it, not changes in behaviour. |
| C1: a culture that encourages positive behaviours and accountability | Light | Lessons 9, 10 and 11 show culture under strain. |
| E1: a governance structure with clear roles, including executive and non-executive ownership | Light | Lessons 2 and 4 test roles during an incident (who decides, who's read in, deputies), not the standing structure. |
| A1: critical processes, information and services identified | Light | Lesson 1 asks how quickly you could list internet-facing systems and their owners. |
| A4: supply chain resilience | Light | Lesson 8 covers suppliers as surge help, not as a risk. |
| A2, A3, A5: risk ownership, risk appetite, regular risk assessment | Partial for A3, otherwise not covered | Lesson 8 asks whether we could cope with a breach in our busiest week or alongside another crisis, and which disruptions the board has agreed it could accept. Defining and communicating the appetite isn't covered. |
| B1 to B4: cyber strategy and resourcing | Not covered | Lesson 8 asks who can approve unbudgeted spending in a crisis, which is a crisis-time version of B3. |
| E2 to E5: reporting and metrics, audit, regulatory awareness | Light for E2, otherwise not covered | Lesson 1 and the session deck ask which measures would show that foundational controls are working. Setting reporting, metrics and tolerances isn't covered. |
Source: Cyber Governance Code of Practice, GOV.UK.
NCSC Cyber Assessment Framework (CAF)
Breach Inc. is useful evidence for one CAF outcome, D1.c testing and exercising. It is partial evidence for staff training (B6.b) and incident-time roles and decisions (A1.b, A1.c). Most of the CAF is about technical and organisational controls, which Breach Inc. doesn't assess. Mapped against CAF version 4.0 (published 18 April 2024, reviewed 6 August 2025).
| CAF outcome | Depth | How Breach Inc. supports it |
|---|---|---|
| D1.c Testing and exercising | Strong, with limits | A facilitated session is an exercise based on a real-world style incident. The CAF also expects scenarios drawn from your own threat intelligence and risk assessment, which a generic scenario doesn't provide unless you adapt it with an organisation licence. |
| D1.a Response plan | Partial | The 29 questions expose gaps in a plan (who's read in, deputies, spending approval, surge capacity, communications). It doesn't check the plan against your essential functions. |
| B6.b Cyber security training | Partial | Training for leaders, with completions recorded by the learning platform package. It is not technical training for the staff who run systems. |
| A1.b Roles and responsibilities | Partial | Lessons 2 and 4 test who decides, who's read in and who escalates during an incident. |
| A1.c Decision-making | Partial | Lesson 6 covers decisions only the board can make, and lesson 8 covers delegated spending authority in a crisis. |
| B6.a Cyber security culture | Light | Lessons 9, 10 and 11 show culture under strain. |
| D2.a and D2.b Lessons learned | Partial | Lesson 11 asks how the team would review a breach without blame and feed the lessons into plans and exercises (D2.b). It doesn't cover root cause analysis (D2.a). |
| D1.b Response and recovery capability | Light | Lesson 8 asks how you'd scale up analysts and call handlers. Technical recovery isn't covered. |
| Objectives B (except B6) and C: protecting systems, detecting events | Not covered |
Sources: CAF principles A1, B6, D1 and D2, NCSC.
NHS Data Security and Protection Toolkit (DSPT)
Breach Inc. is a good fit for the CAF-aligned DSPT's D1.c, which lists tabletop exercises and data breach scenarios. Several of its questions match what the DSPT expects a response plan to contain. The CAF-aligned DSPT applies to larger NHS organisations, such as trusts, since 2024–25. Other organisations, including most GP practices and social care providers, use the standards-based DSPT until their requirements move to the CAF.
| DSPT outcome | Depth | How Breach Inc. supports it |
|---|---|---|
| D1.c Testing and exercising | Strong, with limits | The DSPT lists tabletop exercises and communications tests with the media and public among exercise types. A Breach Inc. session is a tabletop exercise built on a data breach. The DSPT also expects scenarios drawn from your own risk profile and threat intelligence, and findings recorded as time-bound actions. A generic scenario needs adapting (organisation licence) and your own follow-up. |
| D1.a Response plan | Partial | The DSPT expects plans to include key contacts with backups, roles, escalation and regulatory reporting thresholds. Breach Inc.'s questions on deputies (lesson 4), who's read in (lesson 2) and who tells the regulator (lesson 6) test exactly these. Patient-care impacts and safe-care workarounds aren't covered. |
| D1.b Response and recovery capability | Partial | The DSPT expects key roles to be duplicated, and support from suppliers and partners to be agreed in advance. Lessons 4 and 8 test both. Technical recovery and paper-based fallbacks aren't covered. |
| D2 Lessons learned | Partial | As for the CAF. |
| B6 Staff awareness and training | Partial | As for the CAF: leadership training with recorded completions. |
NHS organisations can buy Breach Inc. at the charity and NHS price.
Source: CAF-aligned DSPT guidance, principle D1, NHS England (last edited 15 October 2026).
ISO/IEC 27001:2022
Breach Inc. can be evidence for ISO/IEC 27001 awareness and incident preparation controls, mostly as part of a wider programme. An auditor will look for your own incident procedures and records. Breach Inc. supports those but doesn't replace them.
| Clause or Annex A control | Depth | How Breach Inc. supports it |
|---|---|---|
| 5.24 Incident management planning and preparation | Partial | The questions test whether responsibilities and procedures cover who's read in, deputies, spending approval and communications. |
| 5.5 Contact with authorities | Partial | Lesson 6 asks who contacts the regulator, police and national cyber agency, and when, agreed with Legal in advance. |
| 6.3 Awareness, education and training; clause 7.3 Awareness | Partial | Leadership awareness training with recorded completions. It isn't role-based security training for all staff. |
| Clause 5.1 Leadership and commitment | Light | Shows leaders why their involvement matters. It isn't evidence of commitment in itself. |
| 5.26 Response to incidents | Light | Rehearses leadership decisions, not technical response procedures. |
| 5.27 Learning from incidents | Partial | Lesson 11 asks how lessons from a no-blame review would change plans and the next exercise. |
| 5.29 Security during disruption; 5.30 ICT readiness for business continuity | Not covered | The scenario is data theft, not an outage. |
| 5.25 Assessment of events; 5.28 Collection of evidence | Not covered |
Control numbers and titles are from ISO/IEC 27001:2022 Annex A, which is sold by ISO and isn't freely available.
UK GDPR personal data breach reporting
Breach Inc. rehearses the leadership decisions behind UK GDPR breach reporting: when to tell the regulator, how sure you need to be of the numbers, and how to tell the people affected. It doesn't teach the legal tests or deadlines. The story isn't set in a particular country, so the 72-hour rule never appears.
| ICO expectation | Depth | How Breach Inc. supports it |
|---|---|---|
| Report to the ICO without undue delay, within 72 hours, and in phases if the investigation isn't finished (Articles 33(1) and 33(4)) | Partial | Lesson 3 is about announcing a cautious estimate or waiting for an exact number, and what happens when the number changes. That is the dilemma phased reporting addresses. Lesson 6 asks who contacts the regulator and when. |
| Tell people affected without undue delay when the risk is high, in plain language, with advice on protecting themselves (Article 34) | Strong | Lesson 7 covers a public response people can trust: where to send millions of worried people, and whether they'd believe it was really you. |
| A response plan, with a dedicated person or team, and staff who know how to escalate | Partial | Lessons 2 and 4 test who's read in and who decides. |
| Plan for more data subject requests after a breach | Partial | Lesson 8 asks whose number you'd ring for a thousand extra call handlers. |
| Document every breach, including the facts, effects and remedial action (Article 33(5)) | Not covered | |
| Assess the risk to individuals to decide whether to report | Not covered |
Source: Personal data breaches: a guide, ICO (latest update 20 August 2025).
NACD Director's Handbook on Cyber-Risk Oversight (US)
Breach Inc. maps strongly to the handbook's Tool B, the board's role in cyber incident response. It is a ready-made version of the tabletop exercise the handbook recommends under Principles 4, 5 and 6. It does little for the six principles' work on strategy, measurement and reporting. The 2026 edition was published in April 2026 by NACD with the Internet Security Alliance, with a foreword from CISA.
| Handbook principle or tool | Depth | How Breach Inc. supports it |
|---|---|---|
| Tool B: The Board's Role in Cyber Incident Response | Strong | Tool B lists the stakeholders to contact: regulators, law enforcement, insurers, customers, investors, the media, banks and credit bureaus. Breach Inc. rehearses most of them (lessons 6, 7 and 10). Tool B also covers pre-drafted holding statements (lesson 6), pre-negotiated retainers for response services (lesson 8), and the warning that what's known changes during an incident (lesson 3). Lesson 6 and the session deck add insurers to the outsiders to tell. It doesn't cover backups or technical containment. |
| Principle 2: Monitor legal and disclosure implications | Partial | The handbook asks boards to approve escalation, materiality and disclosure processes before a crisis, and to review simulations that test readiness for deadlines like the SEC's four business days. Lessons 3 and 6 test the people side of this: who signs off the number and the statement. Lesson 5 covers trading blackouts. The game doesn't mention SEC rules or materiality tests. |
| Principle 4: Adopt an enterprise framework | Partial | The handbook says leading boards take part in tabletop simulations that test decision-making under stress. A Breach Inc. session is one. Lesson 8 asks which disruptions the board has agreed it could accept, which raises risk appetite. Resilience metrics aren't covered. |
| Principle 5: Guide risk measurement and reporting | Light | The handbook suggests tabletop exercises with executives and directors to test response coordination and crisis communication. Lesson 1 asks which measures would show the foundations are working. Reporting isn't covered. |
| Principle 6: Encourage systemic resilience and collaboration | Partial | Lesson 6 asks who contacts law enforcement and the national cyber agency. Lesson 1 asks whether rehearsals include key suppliers, matching the handbook's question on tabletop exercises with critical suppliers. |
| Principle 3: Board oversight structures and access to expertise | Light | Lesson 6 asks which leaders would advise the board in a crisis and whether they've done it before. |
| Principle 1: Treat cybersecurity as a strategic risk | Light | The story shows a breach reaching revenue, reputation and trust, not just IT. |
Sources: Director's Handbook on Cyber-Risk Oversight, 2026 and its press release, NACD.
World Economic Forum Principles for Board Governance of Cyber Risk
Breach Inc. supports these principles only lightly. The WEF principles are about strategy, economics and organisational design, and say little about leading an incident. The closest match is Principle 3's call for tested plans for adverse cyber events. The WEF published them in March 2021 with NACD and the Internet Security Alliance. NACD's 2026 handbook now builds on them, so for most boards the NACD mapping above is more useful.
| WEF principle | Depth | How Breach Inc. supports it |
|---|---|---|
| 3. Align cyber-risk management with business needs | Partial | Boards should require written and tested plans for adverse cyber events. Breach Inc. tests a leadership team against the kind of event those plans are for, and its questions show where a plan is thin. |
| 5. Incorporate cybersecurity expertise into board governance | Partial | Training builds directors' cyber knowledge, and Breach Inc. is director-level training. Lesson 6 asks whether the board's advisers have done this before. |
| 1. Cybersecurity is a strategic business enabler | Light | The story shows a breach as an enterprise issue, not an IT matter. |
| 4. Ensure organisational design supports cybersecurity | Light | Lessons 2, 4 and 9 expose the ownership, authority and staffing gaps a breach reveals. Organisational design itself isn't covered. |
| 6. Encourage systemic resilience and collaboration | Light | Lesson 6 covers contacting law enforcement and the national cyber agency. The session deck's NotPetya example shows collateral damage across organisations. |
| 2. Understand the economic drivers and impact of cyber risk | Not covered |
Sources: Principles for Board Governance of Cyber Risk, World Economic Forum; principle titles checked against the Harvard Law School Forum on Corporate Governance summary.
What Breach Inc. doesn't cover
The same areas are outside Breach Inc.'s scope in most of these standards. Use other resources for them.
| Gap | Appears in | Pair Breach Inc. with |
|---|---|---|
| Risk registers and regular risk assessment. Lesson 8 raises risk appetite but doesn't work through it. | All except UK GDPR | The NCSC Board Toolkit risk management module |
| Cyber strategy, resourcing, and board reporting and metrics | Cyber Governance Code (B, E), NACD (Principle 5), WEF (Principle 2) | The Cyber Governance Code's actions, NACD's reporting tools |
| Business continuity and disaster recovery: outages and ransomware | NCSC Board Toolkit, CAF D1.b, ISO 27001 5.29 and 5.30, NHS DSPT | An outage or ransomware exercise, such as NCSC's free Exercise in a Box |
| Supply chain security | All except UK GDPR | NCSC supply chain guidance; invite key suppliers to a Breach Inc. session |
| Technical response: detection, containment, forensics, evidence | CAF Objectives B and C, ISO 27001 5.25 and 5.28 | Technical exercises for response teams |
| Your own scenario | CAF and DSPT D1.c, NACD Tool B | Adapt Breach Inc. with an organisation licence, or run a bespoke exercise |
| Legal tests and deadlines (72 hours, SEC four business days) | UK GDPR, NACD Principle 2 | Briefings from your legal advisers |
Sources
Versions checked on 20 October 2026.
| Standard | Version checked | Source |
|---|---|---|
| NCSC Cyber Security Toolkit for Boards | Version 3.0, reviewed 8 April 2025 | Board Toolkit; question set (PDF) |
| Cyber Governance Code of Practice | Published 8 April 2025 | GOV.UK |
| NCSC Cyber Assessment Framework | Version 4.0, reviewed 6 August 2025 | CAF principle D1 |
| NHS DSPT, CAF-aligned guidance | Page last edited 15 October 2026 | NHS England |
| ISO/IEC 27001 | 2022 edition | ISO (paid standard; not checked against the full text) |
| UK GDPR breach reporting | ICO guide, updated 20 August 2025 | ICO |
| NACD Director's Handbook on Cyber-Risk Oversight | 2026 edition, April 2026 | NACD (PDF) |
| WEF Principles for Board Governance of Cyber Risk | March 2021 | World Economic Forum |
Breach Inc.'s lessons and questions are from the published game at breach-inc.com.