Cyber Crisis Exercise (Tabletop Exercise)

In a ransomware attack, the first hours are spent on questions such as who decides, whether to shut systems down and whom to notify. Searching for these answers during the crisis wastes precious time.

An exercise shows, in a safe setting, whether your incident response plan works beyond paper, whether roles are clear and whether communication holds up.

An exercise is not just an IT activity; effective crisis management requires different functions to make decisions together.

• Executive leadership and the crisis management team
• IT and information security teams
• Legal, corporate communications and human resources
• Business units and key supplier representatives where relevant

• Ransomware: servers encrypted, backups affected and a ransom demand received
• Personal data breach: customer data offered for sale on the dark web and the decision to notify the Turkish Personal Data Protection Authority (under the Board's decision, notification must be made within 72 hours of becoming aware of the breach at the latest)
• Business email compromise: funds transferred on a fake payment instruction
• Supply chain attack: compromise of a software product or service provider you rely on
• Critical service outage: customer services halted by a DDoS or infrastructure attack

1. Preparation: objectives, participants and your current incident response plan are reviewed, and a custom scenario is written.
2. Exercise: the scenario unfolds through staged developments (injects), and participants discuss their decisions and reasoning at each stage.
3. Debrief: participants review together what went well and what needs improvement.
4. Reporting: findings and recommendations are delivered in writing.

• An exercise report covering decision points, observations and gaps found
• Improvement recommendations for the incident response plan, communication plan and role definitions
• A prioritized action list and recommendations for the next exercise