Executive Cyber Crisis Training

The Executive Crisis and Cyber Exercise is an approximately three-hour exercise for an organization’s top-level crisis management team. The exercise is based on a fictional but realistic threat scenario tailored to your organization — such as the spread of ransomware, a leak of sensitive data, or a network disruption hampering operations.
As the exercise progresses, what initially appears to be a minor IT incident begins to escalate. The crisis team convenes and receives information about the situation through inputs provided by the exercise facilitator. Participants are tasked with analyzing the situation, gathering additional information, communicating with relevant stakeholders, and making decisions — under pressure and with incomplete information, just as in a real incident. The Executive Crisis and Cyber Exercise also includes an observer who monitors how situational awareness is maintained, how the situation is being managed, and whether all necessary actions are identified — such as filing reports with the relevant authorities.
Immediately following the exercise, a debriefing session is held. More detailed findings and recommendations for improvement are also compiled into a report.

A cyber exercise is often a revealing reminder. Incident management procedures and responsibilities may not have been as clear as previously assumed. Maintaining situational awareness and ensuring adequate communication are also frequently challenging and require practice. At the same time, cyber exercises often deliver moments of success too: our crisis processes work and we are now better prepared when a real incident strikes!

The Executive Crisis and Cyber Exercise offers the following benefits, among others:

• The team’s ability to manage data breaches and other crisis situations improves.
• Understanding of gaps in incident management processes and communication practices grows, and concrete recommendations for improvement are identified.
• Smooth collaboration between different parts of the organization and its teams is ensured.
• By practicing responses to cyber incidents in advance, recovery to normal operations is more efficient when a real incident occurs.
• Cyber exercise training is also part of comprehensive continuity management and supports building compliance with frameworks such as the ISO/IEC 27001 standard, the NIS2 Directive, and the DORA Regulation.