(Print) Use this randomly generated list as your call list when playing the game. There is no need to say the BINGO column name. Place some kind of mark (like an X, a checkmark, a dot, tally mark, etc) on each cell as you announce it, to keep track. You can also cut out each item, place them in a bag and pull words from the bag.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
“You’re on mute.”
Avoids taking photos/screenshots of client data
Quarterly access review completed
Deletes unexpected attachments
Sensitive data sent via unencrypted email
Default password still in use
Avoids sending sensitive info unencrypted
Hovering over links before clicking
Reports a suspicious text message
Someone says, “That’s a great question.”
Shared credentials discovered
Shreds documents with personal or client info
“This looks like a phishing attempt”
High-risk vendor flagged
Recognizes when someone asks for too much information
Someone says “Let’s take that offline.”
“If it seems too good to be true, it probably is”
Avoids public Wi‑Fi for work tasks
“Can you see my screen?”
Data not classified correctly
Missing evidence for an audit test
Using secure file transfer instead of email
Knows the organization’s security policies exist
Mentions “Think before you click”
Updating software when prompted
Strong passphrase used (not just complex password)
Uses only approved tools for work
Stores sensitive files securely
Recognizes a fake login page
Double-checks external recipients before sending
Creates a strong passphrase (not just a password)
Avoids downloading unknown applications
Uses company‑approved cloud storage
Forwards unusual emails to the security team
Completes annual security training
Verifies sender email address
Validates payment or change requests through a second channel
Knows how to report an incident
Excessive permissions (over‑privileged access)
Missing BAA for a PHI‑handling vendor
Public link sharing disabled on a file
Declines to share information over the phone
Someone mentions “AI” or “Copilot.”
Multi-factor authentication (MFA) enabled
Recognizes a suspicious QR code
Someone mentions “Zero trust.”
“Shadow IT” app found
Firewall rule allows “ANY/ANY” traffic
Employee uses the “Report Phish” button
Reporting a lost or stolen device
USB stick plugged into a corporate laptop
“Sorry, I was on another call.”
Unpatched system identified
Reports a suspicious email
Knows not to plug unknown USBs into devices
“We’ll accept the risk” (without documentation 😉)
Saying “If it seems too good to be true, it probably is”
Attending a security awareness training session
Recognizes a scam or fake offer
Verifying a payment/change request via phone
No documented incident response plan
Uses multi‑factor authentication
Uses approved systems for work files
Vendor without recent SOC 2 report
Computer screen locked when away
Double-checking an external email recipient
Avoids sharing credentials with anyone
Someone’s connection freezes mid‑sentence
Updates software when prompted
Locks computer when stepping away
Phishing email reported
Slide with a lot of tiny text
Free!
Deletes data they’re no longer authorized to retain
Recognizes an “urgent” or “act now” red flag
Uses secure file transfer instead of email attachment
Notices spelling/grammar errors in a suspicious email
