RES / RES-06
Cyber crisis and tabletop exercises
Bring leadership, business teams, IT and support functions together around a crisis scenario without actually attacking production. The exercise tests decisions, coordination, messaging and use of procedures.
WHEN IT HELPS
A focused response
to a defined need.
Untested crisis plan, new leadership, customer requirements, poor team coordination or a need to prepare for operational and reputational impact.
SCOPE & OUTCOMES
What the engagement covers.
Scope
- Objectives
- evolving scenario
- participants
- simulated events
- facilitation
- decision log
- observation
- debrief
- actions
- coordination with a technical exercise if included
Deliverables
- Scenario
- facilitator materials
- decision timeline
- observation report
- strengths and gaps
- improvement plan
- revised procedures where agreed
Acceptance evidence
Key participants are involved; decisions and blockers are observed; actions have owners and dates; lessons are approved; simulation is not confused with a real incident.
DELIVERY
How the work is structured.
Approach
Define objectives and ownership; prepare scenarios and resources; perform authorised response or exercise; document evidence; improve and revise.
Prerequisites & responsibilities
Customer: decision-makers, operations, business owners, legal/insurer where required, permissions and recovery resources. Provider: contracted expertise with evidence preservation.
Scope factors
Criticality, scope, investigation depth, data volume, dependencies, scenarios and mobilisation terms. Preparation, response, rebuilding and licensing are separate.
Questions to clarify
Who decides to stop a service? Who communicates with customers and authorities? Which decisions should genuinely be tested rather than merely discussed?
IMPORTANT BOUNDARIES
A tabletop exercise proves neither technical recovery nor legal compliance. Simulated notifications must never actually be sent without explicit authorisation.
Recovery and investigation have limits; no total recovery or absolute resolution-time promise. Exercise results remain specific to the tested scenario.
IN PRACTICE
Illustrative situations.
These examples describe possible engagements and target outcomes. They are not customer references or achieved results.
Scenario 01
Leadership simulates a ransomware outage. Project: progressively introduce business impacts and external requests. Target outcome: clearer roles and priorities with documented decisions rather than a communication-only exercise.
Scenario 02
A group simulates a customer-data leak. Project: have security, legal and customer teams work with incomplete information. Target outcome: careful messaging and tested decision processes, with unverified facts clearly distinguished.
Technology and reference context
References: NIST preparation and lessons-learned practices; materials and scenarios tailored to the organisation.
The final technology set is agreed during scoping, based on interoperability, licensing, access rights and operating requirements.
CONNECTED SERVICES
Build the next step.
These services can complement the engagement. They are not automatically included.
START A CONVERSATION
Make the scope clear.
We will clarify the objective, dependencies and responsibilities of this service before proposing delivery.