Exercises
Cyber incident exercise
An incident plan works only if people have practised it. We run a tabletop exercise on a scenario from your own environment, with management, IT and communications, and leave a written record of decisions and improvements.
Scope and price are confirmed in writing before work starts.
Discuss your caseThe benefit for your organisation
- People know who decides and who reports before a real incident happens.
- Gaps in the plans are found in an exercise, not during a crisis.
- You receive a record of the decisions, roles and reporting tested in the chosen scenario.
Tabletop exercise
Half a day, up to 12 participants from management, IT, communications and legal. Scenario preparation, facilitation, a written record and an improvement plan.
from €1 900half a day
Extended exercise
A full day, several teams or a supplier in the exercise, more injects in the scenario. Suitable as part of annual plan testing.
by quotationdepending on scope
Why it is needed
- NIS2 requires incident handling, business continuity and crisis management measures (Art. 21(2)(b) and (c)).
- Significant incidents must be reported within tight deadlines: an early warning within 24 hours and a notification within 72 hours (Art. 23). The clock runs while people are still working out who decides.
- DORA requires business continuity and response and recovery plans to be tested at least yearly (Art. 11).
- The exercise is part of a plan-testing programme. Technical recovery of systems is tested separately.
Example scenarios
- Ransomware stops records management, the ERP or the payment system.
- A compromised executive account and an urgent payment request to a new account.
- An incident at your IT supplier that affects your services.
- A personal-data breach: notification according to the risk and applicable thresholds, including to the data-protection authority and to those affected where the risk is high.
How it works
- Preparation: a review of the plans and short interviews, a scenario with injects based on your systems and suppliers.
- Exercise: the scenario unfolds in stages while participants make decisions and draft reports and messages.
- A debrief straight after: what worked and what needs to change.
What you receive
- The scenario and the exercise objectives.
- A written record: decisions, timings, gaps in the plans and in reporting.
- An improvement plan with owners and deadlines.
The decisions-under-pressure part is run with a business psychologist from the team, who observes the process rather than assessing people. See human factors.
Base scope and what you provide
- Preparation: usually 1–2 weeks before the session, with short interviews and a review of the plans.
- Session: half a day, up to 12 participants, one scenario.
- Written record and improvement plan: within 5 working days of the session.
- Involving a supplier or several teams is part of the extended exercise.
Boundaries
- The exercise is a tabletop: no attacks or technical tests on live systems. A restore test is agreed separately.
- We do not assess individuals.
General information, not a legal opinion.