Organisations start a Cyber Crisis Exercise by choosing a realistic scenario, defining objectives, and bringing together leaders from security, legal, communications, operations, and IT. Begin with a tabletop based on likely events such as ransomware or data theft, then capture decision points, escalation paths, and gaps in contact details, authority, and recovery procedures.
What a good starting point looks like
A useful first exercise is narrow enough to complete in one sitting but realistic enough to expose real decision-making. Choose a scenario that the organisation is likely to face, such as ransomware, data theft, or loss of access to a critical system, and define what success looks like before the session begins.
The starting point is not a slide deck or a technical drill on its own. It is a structured conversation that tests how the organisation would actually recognise the event, who has authority to decide, and whether the people in the room can move from concern to action without waiting for perfect information.
For teams that want a practical template for the format, roles, and aftermath review, Tabletop Exercise Guide is a direct fit because it covers objectives, scenario injects, facilitation, participants, and lessons learned.
How to build the first scenario
Start with a scenario that matches the organisation’s actual exposure, then keep the first run small enough to manage. The best early scenarios usually involve a single business-critical service, a plausible initial trigger, and a clear downstream consequence such as inability to process orders, loss of customer data, or disruption to finance or support operations.
Write the scenario so that it forces a sequence of decisions rather than a generic discussion. Good prompts ask who declares the incident, who speaks to the executive team, what evidence is needed before shutting systems down, and what recovery order matters most. If the scenario is too broad, people tend to describe policy instead of revealing how the organisation behaves under pressure.
It also helps to tie the scenario to the organisation’s real dependencies, because a crisis exercise is most valuable when it reveals where business continuity, legal review, communications approval, and technical recovery intersect. If the team cannot explain those intersections during the tabletop, that is already a useful finding.
What to capture during the exercise
The value of the first exercise is not the performance of the scenario itself, but the quality of the gaps it exposes. Capture decision points, escalation thresholds, missing contact details, unclear ownership, delayed approvals, and any place where the team had to invent a process because no one could find an agreed procedure.
Capture how authority actually works, not just how it is documented. Many exercises uncover that the right people are identified on paper but unavailable in practice, or that operational teams do not know who can approve service shutdowns, external statements, or emergency recovery actions. Those are the issues that determine whether the organisation can respond consistently in a real event.
Teams that want to connect tabletop findings to breach lessons can use The State of NHI & AI Agent Breach Report 2026 as a source of real-world compromise patterns, especially where the exercise needs a sharper sense of how stolen secrets, service accounts, and lateral movement affect incident decisions.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.RR-01 — Roles, Responsibilities, and Authorities | Exercises test who decides and who escalates during a crisis. |
| RC.RP-01 — Recovery Plan Execution | The exercise checks whether recovery procedures can be executed in sequence. | |
| RS.CO-02 — Incident Reporting | Tabletop scenarios rely on clear internal and external escalation paths. | |
| Recommendation — Define incident decision authorities before the exercise and validate that escalation roles are understood. Validate recovery sequencing during the tabletop and update the plan where execution is unclear. Test reporting and escalation paths so the right stakeholders are notified quickly. | ||
| ISO/IEC 27001:2022 | A.5.24 — Information security incident management planning and preparation | A crisis exercise is a preparation activity for incident management readiness. |
| Recommendation — Use the exercise to test incident management preparation and identify readiness gaps. | ||
| CIS Controls v8 | CIS-17 — Incident Response Management | The topic is about exercising incident response roles, decisions, and communications. |
| Recommendation — Exercise incident response roles and communications before a real crisis occurs. | ||
Practitioner Guidance
Where to start: Run the first exercise as a tabletop with a single, credible scenario and a short list of objectives. The goal is to surface decision friction, not to test every control at once.
What to verify: Confirm that the people who need to decide can actually be reached, that communications approvals are understood, and that the recovery order for critical services is written down rather than assumed.
What practitioners underestimate: The first failure is often organisational, not technical. Missing authority, unclear escalation, and outdated contact paths usually slow response before the technical recovery process even begins.
Practitioner takeaway: A first cyber crisis exercise should prove whether the organisation can make coordinated decisions under pressure, because that is the part most likely to fail when the incident is real.