(Print) Use this randomly generated list as your call list when playing the game. There is no need to say the BINGO column name. Place some kind of mark (like an X, a checkmark, a dot, tally mark, etc) on each cell as you announce it, to keep track. You can also cut out each item, place them in a bag and pull words from the bag.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
Uses approved systems for work files
Someone mentions “Zero trust.”
Shreds documents with personal or client info
Deletes unexpected attachments
Locks computer when stepping away
Hovering over links before clicking
Vendor without recent SOC 2 report
Verifies sender email address
Computer screen locked when away
Creates a strong passphrase (not just a password)
Data not classified correctly
Notices spelling/grammar errors in a suspicious email
Forwards unusual emails to the security team
Avoids public Wi‑Fi for work tasks
Firewall rule allows “ANY/ANY” traffic
Recognizes an “urgent” or “act now” red flag
Pet appears on camera
Completes annual security training
Deletes data they’re no longer authorized to retain
Recognizes a scam or fake offer
Avoids sending sensitive info unencrypted
Reporting a lost or stolen device
“This looks like a phishing attempt”
No documented incident response plan
Recognizes when someone asks for too much information
Reports a suspicious email
Strong passphrase used (not just complex password)
Multi-factor authentication (MFA) enabled
Someone says, “That’s a great question.”
Shared credentials discovered
Suspicious login alert
Recognizes a suspicious QR code
Missing evidence for an audit test
Double-checking an external email recipient
Knows the organization’s security policies exist
“You’re on mute.”
High-risk vendor flagged
USB stick plugged into a corporate laptop
Verifying a payment/change request via phone
Avoids downloading unknown applications
Updates software when prompted
Employee uses the “Report Phish” button
“If it seems too good to be true, it probably is”
“Shadow IT” app found
Phishing email reported
Reports a suspicious text message
“Can you see my screen?”
Stores sensitive files securely
Using secure file transfer instead of email
Slide with a lot of tiny text
Public link sharing disabled on a file
Free!
Default password still in use
Quarterly access review completed
Avoids taking photos/screenshots of client data
Saying “If it seems too good to be true, it probably is”
Sensitive data sent via unencrypted email
Validates payment or change requests through a second channel
“We’ll accept the risk” (without documentation 😉)
Avoids sharing credentials with anyone
Missing BAA for a PHI‑handling vendor
Identifies a spoofed sender name
Knows how to report an incident
Uses company‑approved cloud storage
Someone mentions “AI” or “Copilot.”
Recognizes a fake login page
Declines to share information over the phone
Someone says “Let’s take that offline.”
Excessive permissions (over‑privileged access)
Someone’s connection freezes mid‑sentence
Identifies suspicious activity on their account
Attending a security awareness training session
Knows not to plug unknown USBs into devices
Mentions “Think before you click”
Uses secure file transfer instead of email attachment
