Docs

Appearance

Runbook: Annual Out-of-Band Communications Test ​

Purpose ​

If Azure, Microsoft 365, or corporate email is unavailable during a real incident, the response team still needs a working communication channel to coordinate. The primary out-of-band channel is a dedicated Signal group covering the three domain administrators (Rory, Kevin, Greg). This runbook validates that channel annually so an incident is never the first time it gets used in anger.

Estimated time: 30 minutes. Run every December.

Related story: BGKIT-008. Related: runbooks/incident-response.md, the future dr-test-checklist.md (IR tabletop should reference this test).

Schedule ​

  • When: Second week of December, every year
  • Who runs it: Rory (or delegate if Rory is unavailable)
  • Who participates: Rory, Kevin, Greg
  • Where the result lives: SharePoint → Compliance → BGKIT → <YYYY>-comms-test.md

Tie this to the existing annual break-glass review so both happen in the same window and a single SOC2 evidence entry covers both.

Pre-Test ​

  • [ ] Confirm Kevin and Greg are available on the scheduled day
  • [ ] Confirm all three participants still have the Signal app installed and signed in
  • [ ] Confirm each person's Signal phone number in the break-glass kit still matches the phone they actually carry (people change phones)
  • [ ] Open the SharePoint folder for this year's test and create the result file from the template below

Test Procedure ​

1. Group is still active ​

  • [ ] Open the dedicated Signal group cirius-breakglass-comms
  • [ ] Confirm all three members (Rory, Kevin, Greg) are still in the group
  • [ ] Confirm no unexpected members are in the group — remove anyone who should not be there and note the change
  • [ ] Confirm the group avatar and name match the documented baseline

2. Messages are received ​

  • [ ] Rory posts a test message: BGKIT annual comms test <YYYY>-12-DD — please acknowledge
  • [ ] Kevin replies within 15 minutes with ack from Kevin
  • [ ] Greg replies within 15 minutes with ack from Greg
  • [ ] Kevin posts a second test message, Rory and Greg acknowledge
  • [ ] Greg posts a third test message, Rory and Kevin acknowledge
  • [ ] Capture a screenshot of the group with all six messages (three prompts + three acks) visible and save to SharePoint

3. Fallback phone numbers work ​

The break-glass kit includes documented phone numbers as a second fallback if Signal itself is down.

  • [ ] Rory places a voice call to Kevin's documented fallback number, confirms it rings and Kevin answers
  • [ ] Rory places a voice call to Greg's documented fallback number, confirms it rings and Greg answers
  • [ ] Kevin places a voice call to Greg's documented fallback number, confirms it rings and Greg answers
  • [ ] If any documented number is wrong or disconnected, update the break-glass kit and re-test
  • [ ] Record each number confirmed in the result file (do not copy numbers into the result file — reference the break-glass kit entry instead)

4. Signal disaster scenario sanity check ​

  • [ ] Each participant confirms they know how to reach the other two without Signal — fallback phone, personal email, SMS — and that those channels are current
  • [ ] Confirm each participant's Signal PIN is not expired (Signal prompts for PIN re-entry every 6 months; an expired PIN on all three devices would block re-entry)

Pass / Fail Criteria ​

PASS — all of:

  • Group membership matches baseline (exactly Rory, Kevin, Greg)
  • All three test messages delivered and acknowledged within 15 minutes
  • All fallback phone numbers verified working
  • No remediation items blocking next year's reliance on this channel

FAIL — any of:

  • A participant cannot be reached on Signal
  • A fallback phone number is wrong or disconnected
  • Someone unexpected is in the group
  • Signal PIN issue that would prevent access in a real incident

Any FAIL requires immediate remediation (update numbers, re-pair devices, remove unexpected members) and a re-test before the test is considered complete for the year.

Result Template ​

Copy this into the SharePoint file at test time.

# BGKIT Annual Comms Test — <YYYY>

Date run: <YYYY>-12-DD
Run by: <name>
Participants: Rory, Kevin, Greg

Group membership matches baseline: PASS / FAIL
Test messages delivered and acknowledged: PASS / FAIL
Fallback phone numbers verified: PASS / FAIL
Signal PIN / access sanity check: PASS / FAIL

Overall: PASS / FAIL

Remediation items (if any):
- ...

Evidence: screenshot of group messages at SharePoint link above.

SOC2 / HIPAA Mapping ​

  • SOC2 CC7.3 — incident communications capability tested
  • HIPAA 164.308(a)(6) — security incident procedures, including communication channels

File the passing result as evidence in the annual SOC2 binder.

Internal use only — Cirius Group