Exercise · Buy on its own or inside the readiness assessment
One realistic scenario, your own people, in your own boardroom. We record what was decided, who had the authority to decide it, and how long each decision took. The elapsed time is the finding.
What it establishes
Almost every response stalls at a decision nobody present has permission to make. An exercise finds those points and puts a number on them, which is a different thing from testing whether your team knows what a firewall does.
How long the room took to decide each thing. "The decision to disconnect took 34 minutes" is a sentence a board and an insurer both understand.
The most common stall is somebody waiting for permission nobody in the room could give. That is a governance finding and it is cheap to fix once named.
Every exercise surfaces at least one. Nothing else does, because in normal operation nobody is asked.
How it runs
We read your incident plan, your IT contract and your insurance policy. Two of those change the exercise, and neither is usually thought of as a security document.
Written to your systems, your suppliers and your customers. A scenario mentioning something you do not own tells everyone in the room it was not prepared for them.
Injects on a clock, each forcing one decision. We do not help. The silence where somebody should know what to do is the finding.
Fifteen minutes of debrief in the room while it is fresh, captured as people said it. A week later the answers are tidier and less true.
What you end up with
Included in the incident response readiness assessment, where it sits alongside the assessment of the plan itself. Bought inside the package it costs less than on its own.
Before you book one
Our incident response plan is free, editable, and filling it in tells you most of what an exercise would. If you complete it and still cannot say who is allowed to disconnect a production system, that is the exercise answering its own question before you have paid for it.