BMW-targeted concept demonstration. Operational entities, suppliers, parts, inventory, production, financial values and incident conditions are synthetic and do not represent BMW systems, performance or current exposure.

Action & decision board

Actions are proposed from approved playbook templates. Nothing is assigned until the incident commander approves it.

INC-2026-0113 · S1 · responding

Approval rule

Commander: L. Marchetti, Incident Commander · 8 awaiting approval · 1 of 16 complete

Immediate containment

Isolate Meridian B2B tunnelP1
Terminate the partner tunnel to SYS-02 and block supplier source ranges at the perimeter.
Owner: A. Fournier · CISO Office
Due: T+1h
Evidence: EV-8
Approval: L. Marchetti, Incident Commander
complete
Template: Isolate affected connection
Disable Meridian service credentialsP1
Disable the EDI service account and portal identities issued to Meridian; preserve logs.
Owner: A. Fournier · CISO Office
Due: T+2h
Depends on ACT-01
Evidence: none attached
Approval: L. Marchetti, Incident Commander
in progress
Template: Disable supplier credentials
Preserve evidence and open chain of custodyP2
Capture broker logs, tunnel netflow and portal audit trail for the 72h window before detection.
Owner: P. Adeyemi · Security Operations
Due: T+4h
Evidence: none attached
Approval: L. Marchetti, Incident Commander
approved
Template: Preserve evidence

Business continuity

Activate manual EDI processing (BCP-1)P1
Stand up portal upload for 830/862 and keyed ASN entry; capacity 220 messages per day.
Owner: S. Bhatt · Continuity
Due: T+4h
Depends on ACT-01
Evidence: EV-7
Approval: L. Marchetti, Incident Commander
in progress
Template: Activate manual EDI process
Notify affected customers of delivery riskP3
Prepare notification for the two fleet customers exposed on Vantage Commercial Van.
Owner: R. Okafor · Supply Chain
Due: T+12h
Depends on ACT-06 — not yet complete
Evidence: none attached
Approval: not approved
awaiting approval
Template: Notify customers

Production & inventory

Confirm affected part numbers at SC Assembly and SaltilloP1
Materials to confirm the traced part list against physical racks; flag any part with no inventory record.
Owner: K. Ruiz · Materials
Due: T+3h
Evidence: EV-3
Approval: L. Marchetti, Incident Commander
in progress
Template: Confirm affected parts
Validate usable inventory excluding quarantineP1
Reconcile WMS on-hand against quarantine holds and safety stock policy for every critical part.
Owner: K. Ruiz · Materials
Due: T+4h
Depends on ACT-04 — not yet complete
Evidence: none attached
Approval: not approved
awaiting approval
Template: Validate available inventory
Prioritise available inventory to RidgelineP2
Allocate remaining stampings to LN-4/LN-5 ahead of Corvin mix; highest revenue per unit.
Owner: M. Delgado · Plant Ops
Due: T+8h
Depends on ACT-05 — not yet complete
Evidence: none attached
Approval: not approved
awaiting approval
Template: Prioritize available inventory
Resequence Final Trim 1 to banked bodiesP2
Activate BCP-3 build-ahead bank to protect Aurora output through the first shift gap.
Owner: M. Delgado · Plant Ops
Due: T+10h
Evidence: none attached
Approval: not approved
awaiting approval
Template: Adjust production schedule

Supplier coordination

Contact Northbend Castings for alternate supplyP1
ALT-1 is qualified with 36h activation and 480/day capacity — request confirmation in writing.
Owner: T. Nakamura · Procurement
Due: T+6h
Evidence: EV-5
Approval: L. Marchetti, Incident Commander
approved
Template: Contact alternate supplier
Request Meridian recovery evidence packageP2
Ask for scope of compromise, containment proof, credential rotation and integrity validation.
Owner: T. Nakamura · Procurement
Due: T+6h
Evidence: none attached
Approval: L. Marchetti, Incident Commander
approved
Template: Supplier evidence request

Technical recovery

Rebuild EDI queue backlog handlingP2
Hold outbound 830/862 in broker queue; prevent duplicate release transmission on restore.
Owner: J. Lindqvist · ERP
Due: T+8h
Evidence: EV-2
Approval: L. Marchetti, Incident Commander
approved
Template: Validate restored transactions

Validation

Validate a live 856 ASN end to endP2
Before reconnection, complete one test ASN from Meridian through the broker into S/4HANA.
Owner: J. Lindqvist · ERP
Due: T+24h
Depends on ACT-12 — not yet complete
Evidence: none attached
Approval: not approved
awaiting approval
Template: Validate restored transactions
Security approval of Meridian environmentP2
Review supplier evidence against the recovery gates before authorising any reconnection.
Owner: A. Fournier · CISO Office
Due: T+30h
Depends on ACT-09 — not yet complete
Evidence: none attached
Approval: not approved
awaiting approval
Template: Conduct security approval

Executive decision

Decision: authorise expedited freight premiumP1
Approve up to $240k expedited freight to compress alternate-source activation.
Owner: COO · Executive
Due: T+6h
Evidence: none attached
Approval: not approved
awaiting approval
Template: Executive decision
Decision: authorise reconnection when gates passP2
Reconnection requires both cyber and operational approval recorded against the gates.
Owner: COO · Executive
Due: T+36h
Depends on ACT-14 — not yet complete
Evidence: none attached
Approval: not approved
awaiting approval
Template: Authorize reconnection

Closed

Isolate Meridian B2B tunnel
A. Fournier · evidence EV-8 · approved by L. Marchetti, Incident Commander