(Print) Use this randomly generated list as your call list when playing the game. There is no need to say the BINGO column name. Place some kind of mark (like an X, a checkmark, a dot, tally mark, etc) on each cell as you announce it, to keep track. You can also cut out each item, place them in a bag and pull words from the bag.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
“Can you see my screen?”
Uses multi‑factor authentication
Someone mentions “AI” or “Copilot.”
Avoids public Wi‑Fi for work tasks
Pet appears on camera
Someone says, “That’s a great question.”
USB stick plugged into a corporate laptop
Mentions “Think before you click”
Someone says “Let’s take that offline.”
Double-checking an external email recipient
Reports a suspicious text message
Deletes data they’re no longer authorized to retain
Uses company‑approved cloud storage
Unpatched system identified
Knows the organization’s security policies exist
Completes annual security training
Vendor without recent SOC 2 report
Default password still in use
Notices spelling/grammar errors in a suspicious email
Strong passphrase used (not just complex password)
Reports a suspicious email
“This looks like a phishing attempt”
Missing BAA for a PHI‑handling vendor
Shared credentials discovered
Double-checks external recipients before sending
Sensitive data sent via unencrypted email
“Shadow IT” app found
Validates payment or change requests through a second channel
Recognizes an “urgent” or “act now” red flag
“Sorry, I was on another call.”
Shreds documents with personal or client info
“If it seems too good to be true, it probably is”
Public link sharing disabled on a file
Creates a strong passphrase (not just a password)
Forwards unusual emails to the security team
Knows how to report an incident
Data not classified correctly
High-risk vendor flagged
Quarterly access review completed
Updating software when prompted
Attending a security awareness training session
Someone mentions “Zero trust.”
Multi-factor authentication (MFA) enabled
Avoids taking photos/screenshots of client data
Identifies a spoofed sender name
Free!
Hovering over links before clicking
Someone’s connection freezes mid‑sentence
Reporting a lost or stolen device
Uses secure file transfer instead of email attachment
Missing evidence for an audit test
Avoids sending sensitive info unencrypted
Updates software when prompted
Recognizes when someone asks for too much information
Recognizes a fake login page
Verifying a payment/change request via phone
Deletes unexpected attachments
Using secure file transfer instead of email
Recognizes a suspicious QR code
Avoids sharing credentials with anyone
Locks computer when stepping away
Recognizes a scam or fake offer
No documented incident response plan
“You’re on mute.”
Declines to share information over the phone
Knows not to plug unknown USBs into devices
“We’ll accept the risk” (without documentation 😉)
Stores sensitive files securely
Uses only approved tools for work
Computer screen locked when away
Avoids downloading unknown applications
Slide with a lot of tiny text
Suspicious login alert
Identifies suspicious activity on their account
Saying “If it seems too good to be true, it probably is”
