Cyber incident simulations move from theory to the boardroom agenda

News summary

An incident response plan may appear comprehensive on paper yet fail as soon as the first real-world situation arises. Who authorises the disconnection of a critical system? How is the provider contacted if corporate email is down? Who decides what is communicated to clients? These questions are bringing cyber-incident simulations onto the boardroom agenda.

Tabletop exercises recreate a scenario without the need to cause a real disruption. Participants receive information in stages and must make decisions with the available data. The advantage is that they allow for the discovery of dependencies, contradictions, and responsibility gaps at a relatively low cost.

A good simulation does not seek to examine individuals. Its objective is to test the response system. For instance, it may reveal that a provider’s contact details are outdated, that only one person knows an emergency password, or that the business area and the technical team have differing priorities.

It is increasingly useful to include management, legal, communications, and operations, not just technology. A serious incident is a business problem, and decisions can affect contracts, reputation, and service continuity.

Following the exercise, improvements must be converted into concrete actions: updating procedures, creating alternative channels, reviewing backups, defining escalation thresholds, or preparing messaging.

It is advisable to repeat these exercises with different scenarios: ransomware, a cloud provider outage, data leaks, or the compromise of a privileged account. Each scenario stresses different decisions. Maintaining a record of pending actions and verifying them in the next simulation turns the exercise into a genuine cycle of improvement.

Concepts mentioned in this article: Cloud · Backup · Business continuity · Ransomware