Strategy, Governance and Training
Executive and Technical Cyber Incident Exercises
We rehearse management and technical team decisions using a cyber incident scenario tailored to your environment. Who decides what and when becomes clear.
What it is
A cyber incident exercise presents each stage of an incident step by step. Management decides on business disruption, communication and regulatory notification. The technical team handles detection, containment and recovery. The exercise shows how the plan works under time pressure with real participants.
Scope
- Scenarios tailored to your organization, such as ransomware, data leak or supplier breach
- Tabletop exercise for the board and senior management
- Technical exercise for SOC and IT teams
- Rehearsing decisions on notifying the data protection authority and sector regulator
- Rehearsing communication with customers, employees and the press
- Decision timeline and lessons-learned report
The need
When organizations need it
- When your incident response plan is written but has never been rehearsed.
- In financial services, when the annual test of response plans is approaching. DORA, for example, requires ICT response and recovery plans to be tested at least yearly.
- When the management team changes or you start working with a new incident response provider.
Method
How we work
-
Objectives
We define what the exercise will test and who will participate.
-
Scenario
We create a realistic incident flow based on findings from your environment.
-
Delivery
We run the exercise and record each decision and its timing.
-
Review
We turn delays and unclear responsibilities into actionable fixes with assigned owners.
Outcome
What you have at the end
You receive a timeline of decisions and the plan's weak points. Fixes are incorporated into the incident response plan and communication templates.
Frequently asked questions
Are systems accessed during the exercise?
In a tabletop exercise, no systems are accessed. In a technical exercise, hands-on steps are performed in a test environment agreed with you.
How long does an exercise take?
Duration is planned based on the scenario and participants. An executive exercise can be kept short to fit management schedules.
Is the scenario shared with participants in advance?
The general framework is shared, but the incident flow is not. This ensures decisions are made on the spot, as in a real incident.
Strategy, Governance and Training
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting