Imagine a critical service becoming unavailable while the security team investigates suspicious activity. The cause is not yet clear. Operations wants continuity, security wants containment and leadership needs an explanation. The difficult part is already underway: deciding what to do before certainty arrives.
Rehearse the decision rights
Who can approve isolating a critical system? Who can accept the operational consequences? Who takes over if that person is unavailable? These questions belong in preparation, when there is time to resolve competing expectations.
An exercise should bring together the people who own those decisions. A purely technical simulation can be valuable, but it will not by itself establish how a leadership team authorises a disruptive business action.
Test the information flow
Early information is often incomplete and subject to revision. A good briefing distinguishes observed facts, working hypotheses and the questions being investigated. This helps leaders act without treating a provisional explanation as a confirmed conclusion.
During an exercise, ask participants to produce the briefing they would actually use. Notice what is missing: business impact, confidence, decision deadlines, options or the identity of the person responsible for the next update.
Include the ordinary dependencies
The most dramatic scenario is not always the most useful one. An unavailable contact list, access to a recovery system or a dependency on a supplier can become decisive when the usual tools are not available.
Work through those details. Can the right people reach each other? Can they access the information they need? Are external responsibilities understood? An exercise earns its value when it identifies a change that can be made.
Observe without turning it into a performance
Participants should be able to explain uncertainty, ask for help and challenge an assumption. An exercise designed only to confirm that the plan works makes it harder to discover where it does not.
Record the decisions, the information available at the time and the points where responsibility became unclear. The purpose is to improve the system of response, including the way people collaborate.
Close the loop after the exercise
The final discussion should produce a short, owned set of improvements. Updating a contact list, clarifying an approval, changing an escalation threshold or practising a handover may be more useful than producing another long document.
Agree how the changes will be checked. The next exercise can revisit the same decision under different constraints, showing whether the organisation has improved its readiness rather than simply repeated the meeting.
Preparation creates a shared way to decide when the facts are still arriving.
A perspective from the Cabinet
The Cybersecurity Cabinet