Cyber crisis management exercise: how to prepare and train your organization?

Major cyberattack, IT incident, data leak, informational attack, industrial accident, unavailability of a critical site or supplier… Whatever the origin of the crisis, an organization must be able to mobilize the right people, understand the situation, coordinate its actions, make decisions under constraint and communicate.

And these skills are not only acquired through documentation.
They train.

The cyber crisis management exercise is thus one of the main levers of crisis preparedness (preparation for crisis management) and crisis readiness (real ability to deal with a crisis): it allows an organization to move from a theoretical system to a real ability to decide and act when a critical situation arises.

What is a cyber crisis management exercise?

A cyber crisis management exercise is a controlled situation designed to train an organization to deal with an event that is likely to significantly disrupt its operations.

Based on a scenario built beforehand, the participants are confronted with a succession of events, requests and information to which they must react as they would in a real situation. The objective is therefore not only to verify that a plan exists.

The aim is to test the teams’ ability to:

• detect and qualify a situation;
• alert and mobilize the right people;
• activate the appropriate cells;
• consolidate and share information;
• coordinate several teams or crisis units;
• anticipate possible developments;
• investigating arbitrations;
• make and draw up decisions;
• maintain priority activities;
• communicate with the various stakeholders.

An exercise does not only test a device. It trains the women and men who will have to bring it to life. This is the difference between having a crisis system and being ready to manage a cyber crisis.

Why organise cyber crisis management exercises?

Because a crisis never looks exactly like what was planned.

Procedures, continuity plans, reflex sheets, crisis directories or escalation matrices are an essential foundation. But they do not make it possible, on their own, to verify how an organization will react when several difficulties arise simultaneously.

• Who alerts whom?
• When should the crisis unit be activated?
• Who has the information?
• How to share it?
• Who can decide?
• On what basis?
• How to articulate technical response, business continuity, regulatory obligations, commercial issues and communication?

It is often in the interfaces that the main weaknesses are to be found.

The exercise makes it possible to reveal them precisely before a real crisis does. It also makes it possible to develop common reflexes between actors who sometimes do not work together on a daily basis: technical teams, business lines, management, legal, communication, human resources, security, risks or business continuity.

As the exercises are repeated, the participants know their role better, the decision-making circuits become more fluid and the organization gradually develops its readiness.

Cyber crisis management exercises and regulatory obligations

The answer depends on the sector of activity, the applicable regulations and the nature of the devices concerned.

Several regulatory frameworks and resilience requirements now require organizations to regularly test their response systems, plans and capabilities. This is particularly the case, depending on the organizations concerned, in the context of digital operational resilience, cybersecurity or business continuity.

The requirements resulting from DORA, NIS2, but also from certain sectoral standards, contracts, group policies or insurance requirements reinforce this logic of regular testing.

But reducing cyber crisis management exercises to a compliance obligation would be to miss their main interest.

Compliance makes it possible to demonstrate that we are testing. Preparedness consists of ensuring that we will really be able to act.

A useful exercise must therefore not only answer a box in a control program. It must be built on the basis of the risks, vulnerabilities, level of maturity and objectives specific to the organization.

Why prepare for a cyber crisis when we are already investing in cybersecurity?

Cybersecurity devices aim to reduce the likelihood of a cyber incident, but no system is foolproof. The most sophisticated cyberattacks regularly manage to bypass protection, detection, and response measures.

The question is therefore no longer just how to prevent an attack, but how to manage a cyber crisis when it occurs.

Cyber crisis preparedness helps to limit the operational, financial, regulatory, human and reputational impacts of a major incident, while strengthening the organization’s ability to make the right decisions under pressure.

How do I know if my organization is ready to handle a cyber crisis?

The ability to manage a cyber crisis (cyber crisis readiness) is certainly based on the tools available to teams to detect, isolate and understand the situation, but also on the existence of clear governance, adapted procedures, defined roles, a proven crisis management organization and regular exercises.

The best indicator of the maturity of a cyber crisis management system is often the real ability of the teams and the crisis unit to make relevant decisions under pressure, in a context of uncertainty, during realistic simulations.

Do we already need to have a mature cyber crisis system to organise an exercise?

No. It is even an idea that sometimes leads organizations to postpone their first training unnecessarily: “We will practice when our system is finalized.” However, a cyber crisis management system is never fully finalized.

A first exercise can make it possible to test the principles imagined, identify areas of fragility and make progress in the system. The important thing is to adapt the level of difficulty to the objectives and maturity of the organization.

For an organization with little training, an exercise can, for example, focus on alerting, mobilization, distribution of roles and first reflexes.

A more mature organization may work on complex scenarios involving multiple cells, multiple countries, or multiple sites, difficult trade-offs, strong media pressure, or simultaneous business continuity issues.

We don’t train because we’re ready. We train to become one.

How often should cyber crisis management exercises be organised?

There is no universal frequency. Organising a major exercise once a year can be a basis, but it is not necessarily enough to keep an entire system in operational condition.

The most mature organizations think more in terms of training programs. They can combine, throughout the year, mobilization tests, targeted training, tabletop exercises, technical exercises and larger-scale cross-functional simulations.

The objective is to maintain reflexes, integrate new employees, test the changes to the system and gradually work on different situations.

An isolated exercise gives a photograph. A training program builds resilience.

The different types of cyber crisis management exercises

Not all exercises pursue the same objectives.

What are the specificities of a cyber crisis management exercise?

A cyber crisis has several characteristics that make its training particularly important.

The first is uncertainty. In the first few hours of a major cyberattack, the organization rarely has a complete picture of the situation. The scope of compromise evolves, investigations take time, and some information may be contradictory.

However, action must be taken. Should certain systems be shut down? Can production be maintained? Has data been exfiltrated? Which customers are affected? Should we communicate? Which authorities should be informed? When can we envisage a takeover?

The crisis unit must take decisions while the technical investigation continues.

The second difficulty lies in the multiplicity of actors involved. CERT, SOC, CISO, CIO, business lines, general management, DPO, legal, communication, human resources, insurers, incident response providers or authorities can be mobilized simultaneously.

A cyber crisis management exercise must therefore work on both the response to the digital crisis itself and the interfaces between these actors. Because a major cyberattack quickly ceases to be a simple computer incident. It can become an operational, legal, commercial, financial, reputational and sometimes human crisis.

What events can be simulated during a cyber or hybrid crisis management exercise?

The most frequent crisis scenarios

There is no standard scenario. The scenario must be chosen according to the risks of the organization and especially the capabilities that you want to train. It can be a major cyberattack or ransomware, a data leak, a compromise of a supplier, an attack on the supply chain, an unavailability of the information system or the cloud, a major IT incident, an informational attack or a disinformation campaign, fraud, sabotage, an industrial accident, the unavailability of a critical site, a supply disruption or a reputational crisis.

Several events can also be combined. A cyberattack can cause a production stoppage. A data leak can generate media pressure. An informational attack can amplify a crisis that is already underway. This combination makes it possible to work on complex and realistic crisis situations.

However, the most spectacular scenario is not necessarily the best exercise. A good scenario is one that confronts participants with the difficulties, interfaces and decisions they must learn to manage.

Integrating informational attacks into the preparation of a cyber crisis

Cyberattacks are increasingly accompanied by an informational attack: disclosure of data, disinformation, destabilization campaigns, identity theft or media pressure. Preparation for cyber crisis management must therefore integrate these scenarios, provide for monitoring mechanisms, communication procedures and response methods in the face of a rapid deterioration of the information environment.

However, it is necessary to go beyond the mere articulation between cyber and informational. Some crises are exclusively informational and aim to destabilize an organization, its managers or its activity, without any technical incident necessarily being observed. These operations can take the form of coordinated campaigns of disinformation, manipulation of information or damage to reputation.

In this context, the anticipation of cyber and digital crises cannot be limited to cyberattack scenarios alone. It must also provide for systems for detecting, analysing and responding to informational attacks.

In this respect, VIGINUM’s work and publications are a valuable reference for understanding the operating methods observed and strengthening the readiness of organizations to face these new forms of threat.

Mobilising and coordinating your crisis unit

Who should be involved in a cyber crisis management exercise?

It depends above all on the objectives. A cyber exercise can involve the CERT or SOC teams, the CISO and the IT department, but also the business lines, business continuity, general management, legal, DPO, communication, human resources or security. However, it is neither necessary nor desirable to systematically mobilize the entire organization.

An effective training strategy is based on progression.

Some exercises may target a particular unit. Others will test an interface: CERT and decision-making unit, for example, or crisis and communication unit. Finally, a cross-disciplinary exercise can make it possible to train the entire system simultaneously.

This work-study program allows you to work on certain skills in depth while regularly checking the organization’s ability to function collectively.

Can we train several crisis units simultaneously?

Yes. And in complex organizations, this quickly becomes essential. A cyber crisis can simultaneously mobilize a technical cell, an operational cell, a strategic crisis cell, a general management and several local entities. Each has its own level of information and its own responsibilities.

The multi-cell exercise therefore makes it possible to test not only the functioning of each cell, but also the circulation of information and coordination between the different levels of the system.

It is precisely to reproduce this complexity that Alcyconie has developed PIA®, its immersive platform dedicated to crisis management exercises and training.

PIA® makes it possible to recreate, in a closed environment, the information ecosystem that players may be confronted with: messaging, simulated social networks, media, directory, events and scripted stimuli.

Several cells can thus evolve simultaneously in the same scenario, each being confronted with the information and solicitations intended for it. The objective is not to artificially complicate the exercise, but to recreate the interactions that make a crisis a reality.

How do you make a cyber crisis exercise truly immersive?

Immersion is not based solely on technology. It starts with a credible scenario, adapted to the organization’s activity and sufficiently documented for participants to believe in it.

It is then based on the quality of the stimuli. A journalist calls. An employee publishes information. A customer asks for an explanation. An authority asks the organization. A subsidiary reports a new problem. A screenshot appears on social networks.

These events must happen at the right time and with enough realism to push players to analyze, prioritize and decide, without turning the exercise into an artificial accumulation of incidents.

The PIA® platform makes it possible to manage this informational pressure and to recreate a realistic environment while remaining fully controlled by the animation team. “Accomplices” can also intervene during the exercise to embody certain stakeholders and make interactions even more realistic.

Prepare your cyber crisis management exercise

Two key steps to follow for a successful preparation

The quality of an exercise depends largely on the work carried out before the big day. The first step is to determine what you really want to train or test. This can be the mobilization of the unit, the operation of a new system, the coordination between several teams, the ability of the Executive Committee to arbitrate or the response to a particular risk.

The perimeter and the participating populations are then defined. The scenario can then be constructed. It must make it possible to achieve the educational objectives without becoming predictable. A timetable specifies the evolution of the situation, the information communicated to the players, the stimuli, the interactions with the accomplices and any possible adaptations during the exercise.

Remember: an exercise is not a film whose scenario must be played to the end. The animation must be able to adapt to the decisions made by the players.

Finally, the observation methods and evaluation criteria must be prepared in advance so that the feedback is based on objective elements.

How long does it take to prepare for a cyber crisis management exercise?

The visible duration of the exercise does not reflect its preparation time. A two- or three-hour exercise may require several weeks of design. Preparation depends on the number of cells involved, the level of customization of the scenario, the complexity of the organization, the number of stimuli or accomplices mobilized and the level of immersion sought.

The more accurately the exercise must reproduce the organization’s environment, the more important the preparatory work. This is particularly the case for multi-cell, international exercises or exercises involving technical and decision-making teams simultaneously.

A cyber crisis exercise, and then?

Measuring the success of a cyber crisis exercise

The success of an exercise is not measured by the fact that the participants “found the right answer”. A crisis rarely has a single response. The evaluation should focus more on how the organization has functioned.

• Was the situation correctly qualified?
• Have the right people been mobilized?
• Has the information been consolidated and shared?
• Did the cells have a common vision?
• Have the decisions been examined and then taken at the right level?
• Have they been drawn?
• Have the medium-term consequences been anticipated?

A successful exercise can perfectly reveal many difficulties. It is often even a sign that it has been useful.

It is better to identify a weakness during a financial year than to discover it in the middle of a crisis.

How can we identify the progress made in cyber crisis management?

Progress in cyber crisis management can be assessed through various indicators:

• results of crisis exercises,
• time to mobilize teams,
• quality of decision-making,
• effectiveness of crisis communication,
• control of regulatory obligations or reduction of impacts during real incidents.

Maturity in crisis management is really built over time.

From RETEX to roadmap

The exercise does not stop when the scenario ends. An initial debriefing allows us to collect the feelings of the players and observers. It must be supplemented by feedback – RETEX to identify the strengths, the difficulties encountered and the areas for improvement.

These findings must then be translated into concrete actions: updating a procedure, clarifying a role, evolving an alert circuit, improving a tool, training a population or organising new targeted training.

The RETEX must thus feed a real continuous improvement loop:

1. Prepare
2. Train
3. Observe
4. Improve
5. Train again

How to build a cyber crisis management training program?

An effective training strategy starts with a simple question: where do we want to improve?

The organization can first assess its level of maturity and identify the populations, interfaces or scenarios that need to be worked on. It can then build a trajectory over several years by varying the formats, populations and levels of difficulty.

A COMEX doesn’t need to be confronted with the same ransomware every year. A CERT doesn’t need to be trained in the same way as a communications team. A newly integrated subsidiary doesn’t necessarily have the same level of maturity as the head office.

The logic of crisis preparedness consists precisely in building this progress. The challenge is no longer to “have done your annual exercise”, but to have an organization whose ability to deal with a critical situation is maintained, measured and gradually strengthened.

Why call on a specialist to organise a cyber crisis management exercise?

Building a realistic exercise requires mastery of crisis mechanics, instructional design, facilitation and the issues specific to the chosen scenario. The external perspective also makes it possible to confront the organization with situations that it would not necessarily have imagined itself.

In the cyber field in particular, experience in real situations makes it possible to reproduce very concrete difficulties: partial technical information, changes in the scope of compromise, time pressure, continuity arbitrations, external requests or difficulty in coordinating the various cells.

The role of the facilitator is not to make the participants fail, however. It is to create the level of pressure and uncertainty necessary to help them progress.

Cyber crisis management exercises with Alcyconie

Alcyconie designs and conducts tailor-made cyber and hybrid crisis management exercises, from targeted cell training to complex simulations involving several operational and decision-making cells simultaneously.

Our approach is based on our experience in preparing organizations but also in supporting real crises.

This double experience allows us to build realistic scenarios, to identify the difficulties that the cells will really face and to adapt the animation to the reactions of the participants.

Major cyberattack, data leak, IT incident, informational attack, industrial accident, unavailability of a site or other critical situation: the scenario is always built in the service of training objectives.

Our exercises can be based on PIA®, our immersive platform dedicated to crisis management training, in order to reproduce the informational pressure, interactions and multi-cell coordination of a real situation.