DRI CANADA

DRI CANADA Providing a knowledge base for Business Continuity Planning/ Disaster Recovery Professionals.

When do you notify — when you're sure, or when you're suspicious?Inject Three puts' teams in the gap between those two. ...
09/01/2026

When do you notify — when you're sure, or when you're suspicious?

Inject Three puts' teams in the gap between those two. There's evidence of data exfiltration. There's an extortion demand. But degraded systems mean you can't yet confirm what was taken, or how much. Meanwhile the clock on your legal and regulatory obligations may already be running — privacy commissioners, sector regulators, OSFI and FINTRAC for the financial teams, and potentially affected individuals.

Notify too early and you may alarm people over a breach that turns out limited. Wait for certainty and you may blow a mandated timeline and compound the reputational hit.

There's no formula. There's only a decision — made under uncertainty, on incomplete information, exactly like the real thing.

How does your organization decide?

Learn more: https://www.dri.ca/great_canadian_disaster.php

'Get us back online.' 'Don't reconnect anything.' Same incident. Same organization. Two leaders — both right.It's the te...
08/31/2026

'Get us back online.' 'Don't reconnect anything.' Same incident. Same organization. Two leaders — both right.

It's the tension at the heart of The Great Canadian Disaster, and it only gets sharper in Inject Three. Restoring service fast keeps the business alive. Reconnecting a compromised environment could spread the attack into the one clean system you have left.

In Inject Two, the strongest teams didn't just pick a side. They pre-defined the evidence that would let them move: recovery environment scanned, no indicators of compromise, authentication trusted, monitoring live. A go/no-go checklist decided before the pressure hit — not during.

The worst time to invent your reconnection criteria is the moment leadership is demanding you reconnect.

Does your plan spell out what 'safe to fail over' actually means?

Learn more: https://www.dri.ca/great_canadian_disaster.php

Inject Three is live — and you don't have to be a registered team to get value from it.Read the scenario. Sit with your ...
08/28/2026

Inject Three is live — and you don't have to be a registered team to get value from it.

Read the scenario. Sit with your own organization's version of it. Ask the four questions our teams are wrestling with this week:

• The extortion demand — engage, refuse, or refer? Who decides?
• Notification — do you report a breach you can't yet scope?
• Priorities — two investigations, one forensic team, load-shedding required. What gets power?
• Communications — what do you tell staff and customers when you don't yet know?

If you're a participating team, submissions are open now. If you're not — run it as a lunch-and-learn. The gaps you find on paper are the ones you won't find at 2 a.m.

Test your plans before reality does.

Learn more: https://www.dri.ca/great_canadian_disaster.php

'We'll switch to manual processes.' Almost every continuity plan says it. Inject Three asks the harder question: for how...
08/27/2026

'We'll switch to manual processes.' Almost every continuity plan says it. Inject Three asks the harder question: for how long?

By day two of our scenario, manual workarounds aren't a stopgap — they're how the organization runs. Fuel resupply is 48+ hours out. Staff are fatigued. And here's what teams told us in the debrief: very few had actually quantified their manual capacity. How many transactions? For how many hours? Before error rates climb and the wheels come off?

'Manual as a fallback' is a plan. 'Manual for 72 hours, with this many people, at this error rate' is a capability.

Do you know your number?

Test your plans before reality does.

Learn more: https://www.dri.ca/great_canadian_disaster.php

📣 Strengthen your crisis communication skills! Join BCP COMMS (Sep 8–11, Hybrid/Toronto) and gain confidence in handling...
08/26/2026

📣 Strengthen your crisis communication skills! Join BCP COMMS (Sep 8–11, Hybrid/Toronto) and gain confidence in handling media and stakeholder messaging. Register: https://buff.ly/GLo0ViX

One thing nearly every team got right in Inject Two: they refused to speak before they could verify.Single source of tru...
08/25/2026

One thing nearly every team got right in Inject Two: they refused to speak before they could verify.

Single source of truth. Verified facts only. Vendor advisories cross-checked before acting on them. Staff told not to speculate. Public messaging aligned with government on a national event.

It sounds obvious — until you're four hours into a crisis, the phones are ringing, leadership wants answers, and even your trusted vendor advisories have gone uncertain. That's when the temptation to fill the silence with a guess becomes overwhelming.

The teams that held the line kept public trust intact. And the lesson carries straight into Inject Three, where a data breach you can't yet scope will test that discipline all over again.

What do you tell people when you don't yet know the answer?

Learn more: https://www.dri.ca/great_canadian_disaster.php

Here's the uncomfortable truth Inject Three is built around: your worst day is an attacker's best opportunity.When your ...
08/24/2026

Here's the uncomfortable truth Inject Three is built around: your worst day is an attacker's best opportunity.

When your monitoring is degraded, your staff are exhausted, and your defenses are stretched thin across a physical crisis — that's not when threats pause. That's when opportunists move.

The grid attack in our scenario is a nation-state operation. The second intrusion is something else entirely: a criminal group taking advantage of the chaos to steal data and extort. Two unrelated adversaries, hitting the same organization at the same time, for completely different reasons.

Most continuity plans assume one crisis at a time. Real events rarely cooperate.

Does your plan account for a cyber incident landing in the middle of another emergency?

Test your plans before reality does. https://www.dri.ca/great_canadian_disaster.php

📍 Toronto — strengthen your BC capabilities with BCLE 2000 (Oct 24–27). Register: https://buff.ly/2ixaLLZ
08/24/2026

📍 Toronto — strengthen your BC capabilities with BCLE 2000 (Oct 24–27). Register: https://buff.ly/2ixaLLZ

Your systems are degraded. You can't confirm what data was stolen. But the extortion demand is real: pay, or it all goes...
08/21/2026

Your systems are degraded. You can't confirm what data was stolen. But the extortion demand is real: pay, or it all goes public.

In the middle of a national outage, with your team already stretched to breaking — what's your first move?

🔒 Refuse and refer to law enforcement
📞 Engage to buy time and learn the scope
🔎 Say nothing until forensics confirm the breach
📣 Notify regulators & affected people now, on suspicion

There's no clean answer — which is exactly the point of Inject Three. Drop your call in the comments, and what would drive it.

Test your plans before reality does. https://www.dri.ca/great_canadian_disaster.php

Address

701 Rossland Road East, Suite 375
Whitby, ON
L1N9K3

Opening Hours

Monday 8:30am - 5pm
Tuesday 8:30am - 5pm
Wednesday 8:30am - 5pm
Thursday 8:30am - 5pm
Friday 8:30am - 5pm

Telephone

+18442288135

Website

Alerts

Be the first to know and let us send you an email when DRI CANADA posts news and promotions. Your email address will not be used for any other purpose, and you can unsubscribe at any time.

Contact The Business

Send a message to DRI CANADA:

Shortcuts

Share

Category