Crisis Management and Incident Response Exercices

Use Cases

Our engagements ultimately help organizations' cyber resilience by stressing your team about their incident response capabilities.

The scope for each service is fixed and includes defined outcomes; however, we can work with you to reasonably customize the scope if needed. The Service unit value (1 Service Unit=5 hours) and sizing - (S)mall, (M)edium, (L)arge - listed in this catalog are based on your organizational or network infrastructure size and are subject to adjustment based on the specific engagement objectives and desired outcome.

All services in this catalog, including related communication and documentation, are delivered in English, remotely or on-site. Local language options may be available. Please, engage with us to get more details on the service descriptions.

All services are available (and sized as Small, Medium, Large) as standalone engagements or through a prepaid retainer (10 to 50 service units).

Service Features

Incident Response-led Exercises

IR Fundamentals Training

Training series is predicated on a philosophy of equipping organizational resources with the foundational skill sets to respond to a cybersecurity incident. Preparation is multifaceted, focusing on managing cybersecurity incidents and training first line responders. The IR Fundamentals Training series helps resolve common knowledge gaps and, ultimately, helps an organization respond in a more efficient manner (Principles of Incident Response Training, Incident Commander Training, Attacking and Defending Active Directory).

• IR Training (S:8 per course)

Functional Exercise

We offers both functional exercises and drills (explained below). These exercises and drills elevate the level of your readiness testing, allowing your incident response (IR) team members to practice their roles and responsibilities, and to execute processes in one or more functional areas of an IR plan. Each exercise can vary in complexity and scope, from validating specific aspects of a plan (a drill) to validating multiple aspects of a complete IR plan (a functional exercise).

Drills are brief exercises that test a specific IR capability. Examples of capabilities that IR drills can test are: How quickly can our on-call team activate our external IR provider? Can all team members rapidly triage an alert and isolate a compromised server?

‍Functional Exercises are wide-scope response scenarios with hands-on elements, conducted in realistic, real-time environments involving multiple functions. An example of such an exercise is: “Your tools show critical alerts that joebloggs@xxxxxxxx.com has been phished. Demonstrate how you follow your response process—from triaging the alerts, notifying the appropriate parties, and acquiring all relevant data, to conducting the technical investigation for understanding the root cause, identifying any data loss, and concluding the investigation.”

• Functional Exercise (S:16, M:24)

Tabletop Exercise

An incident response (IR) Tabletop Exercise assembles primary stakeholders and uses a scripted incident scenario to practice incident response. The exercise facilitator releases information in a controlled manner that will guide the exercise, while each stakeholder describes their response as if it were a real incident. An IR Tabletop Exercise is an efficient way to familiarize your organization's personnel with IR practices and the exercise proactively tests existing response capabilities, including the validation of roles, responsibilities, coordination, and decision making.

• External Penetration Test (S:8, M:16, L:32)

Adversary Group-led Exercises

cf. our service descriptions from our VOC pillar.

Crisis Management Exercises (Full Spectrum including Management team)

This service is delivered by our colleagues from Abilene Advisors, based on methodologies combining ISO 27035-aligned incident response frameworks with ISO 22301-grounded business continuity testing — tailored to your threat profile, your team's maturity, and your regulatory obligations.

Key scenarios this service addresses:

• Organizations that have incident response or BCP/DRP plans but have never tested them end-to-end
• Security and IT teams that need to validate detection-to-containment procedures against realistic attack scenarios
• Leadership teams that must demonstrate crisis readiness to regulators, auditors, or boards under NIS2, DORA, or ISO 22301
• Organizations that have completed a previous exercise and want to track measurable improvement over time
• Environments where coordination between IT, legal, communications, and executive leadership has never been stress-tested

Framework & Planning Foundation

• Delivery of a complete IR and BCM framework aligned to ISO 27035 and ISO 22301, operational-ready and tailored to your environment — not a generic template.
• Development of incident playbooks and response procedures mapped to your specific threat landscape, systems, and team structure.
• Pre-exercise BCP/DRP analysis and gap assessment to identify critical processes, hidden dependencies, and untested assumptions before the exercise begins.

Exercise Design & Facilitation

• Progressive exercise typology matched to your maturity: tabletop discussions (TTX) for discussion-based scenario walkthrough, functional exercises for coordination and procedure validation, and full-scale live drills testing actual systems and real-time decision-making under pressure.
• Realistic, dynamic scenario injects — developed in collaboration with media and external partners — introducing time pressure, incomplete information, cascading events, and stakeholder simulation to replicate how teams actually respond, not how they think they will.
• Professional facilitation and exercise control throughout, with comprehensive observation and performance documentation.

Outcomes & Continuous Improvement

• Post-exercise report delivering a prioritized analysis of strengths, gaps, and specific remediation recommendations — each finding with a clear improvement path.
• Post-exercise gap analysis and remediation roadmap, turning exercise findings into structured improvement actions rather than a list of observations.
• Lessons learned integration plan ensuring findings feed back into updated playbooks and procedures.
• Continuous improvement support through regular testing cycles (recommended 2–4 times per year), post-incident reviews, and playbook updates — building measurable resilience maturity over successive exercises.

What Makes This Different

• Blameless learning environment by design: exercises are framed as capability-building, not performance evaluation — creating the psychological safety needed for teams to discover and acknowledge real gaps.
• Findings from exercises consistently surface 10–15 issues per session, including critical ones that would have been catastrophic in a real incident — covering decision authority ambiguity, unrealistic RTOs, restore procedure failures, and communication breakdowns.
• Regulatory alignment built in: exercise design and documentation support audit readiness under NIS2, DORA, ISO 22301, and ISO 27001.

‍