The aim of this support resource is to ensure:

• Executives and Managers have an awareness of how to use Immersive Crisis Simulations to build Cyber Operational Resilience and,
• Can use Immersive Crisis Simulations to improve security teams' incident & crisis management capability

The importance and benefits of running Crisis Simulations and Exercises

Importance of Crisis Exercising

Cyber threats are ever-present and constantly evolving, forcing organizations to better prepare for the unexpected. One effective way to prepare is through crisis simulations and exercising, which simulate real-world cyber attacks as well as other crisis situations and test an organization's response capabilities under pressure.

From technical teams to executive decision-makers, crisis simulations exercise teams together to build trust and confidence in their knowledge, skills, and judgment in responding to actual incidents - removing the isolation gap between technical and management teams.

Benefits of crisis exercising

• Improved communication - Facilitates better communication and collaboration across different departments, leading to a shared understanding of goals, priorities, and challenges
• Greater efficiency - Promotes a common approach to problem-solving, testing, and decision-making – resulting in more efficient use of resources and streamlined processes
• Enhanced leadership skills - Develops and builds upon leadership skills at all levels of the organization, enabling employees to take ownership of their work and lead their teams more effectively
• Increased accountability - It creates a sense of shared responsibility for organizational outcomes, promoting a culture of accountability and continuous improvement
• Better alignment - It ensures that organizational goals and strategies are aligned across different levels, ensuring that everyone is working towards the same objectives

The Key Principles you should follow when developing your crisis simulations and exercising program

Key principles in crisis response

• Apply these to all your crisis simulations and exercises:
• Move the organization from mayhem to management as fast as possible
• Move fast! Social media is instant
• Have a clear line of command for who “signs off” any communications release
• Monitor what else is going on and what is being said - what you don’t know is as important as what you do know.
• “Feed the beast”. Release news little and often to the media/stakeholders
• Be human - apologize if you need to.

How to use Immersive Crisis Simulations to maximize your preparation and improve your crisis management capability

Responding to a cyber incident depends on diverse teams with different skills and perspectives coming together as one. Make sure your crisis simulations and exercises involve technical and non technical teams as well as various business functions.

Exercising cadence and modality - Run exercises to build capabilities, muscle memory, and confidence. Make sure you have a regular cadence of crisis simulations and exercises - frequency can differ between organizations.

Scale up and benchmark performance - Consider creating a ‘template’ exercise aligned to key organizational or functional areas of focus or concerns.

The overall scenario remains the same but can be quickly adapted to each specific location or line of business and run in different formats (single player, drill or presentation mode)

Let the data do the talking

• Run exercises to evidence decision paths taken by different functions and teams across the organization.
• Compare results (including confidence levels) by role/level, locations, and/or business lines for a snapshot of organizational cyber resilience capability
• Use that data as part of your Executive exercise to demonstrate the benefits of your program.
• Build confidence across the executives and showcase areas of focus for your program

Simulation and Exercise Delivery Options - Make sure you utilize all play modes to achieve your goals and outcomes depending upon realism and simulated events.

Exercising Best Practices

• Define your Goals - Set goals and aims for the exercise.
• Identify Audience & Participants - Identify participant teams and key decision-makers who should be part of the exercise.
• Select your Scenario or Template - Determine if you want a realistic or fictional scenario & Identify attack vector or threat actor.
• Customize Scenario (if applicable) - Align number of injects with the estimated time you’ll schedule for the exercise.
• Identify Exercise or facilitation mode - There are several ways you can run an exercise, select the style that meets your goals
• Complete Test Run of Exercise - Practice facilitating the scenario before your actual session.
• Schedule Exercise - Determine duration of the event - leverage the test-run to ensure you optimize the exercise time
• Send Advance Communications - Send calendar invites and reinforce why users need to be part of the exercise.
• Exercise Preparation and Logistics - From technical setups to briefing documents, ensure all logistical aspects are planned.
• Run Exercise - Ensure the facilitators are clear on the flow of the injects and intended goal.
• Debrief - Wrap up the exercise with a conclusion and debrief summary. If you wish you can conduct a facilitated debrief at a later date.
• Results Analysis - Review results and analyze trends from users' decision and confidence scores.
• Debrief - Hold a Post-Exercise debrief

10 Tips for running crisis exercises

1. Understand the objectives and scope
2. Plan your timings and stick to them
3. Have backup injects and questions prepared
4. Tailor the scenario and injects to specific roles
5. Tailor how you deliver information
6. Utilize breakout rooms
7. Use anecdotes and get people to share their experiences
8. Try not having everyone come to the room / the call before starting the exercise
9. Let them make mistakes
10. Be prepared to be challenged