1. Target Audience
Chief executives, directors and senior managers who would lead your response. That typically includes operations, communications, legal, information governance and your cyber or IT lead.

2. Duration
1 day, for 6 to 12 participants.

3. Delivery Mode
At your premises or a London venue we arrange. Includes a scoping call, a scenario tailored to your organisation, and a written report within 10 working days.

4. Aims
If a cyber attack took your services offline tomorrow, would your leadership team know who decides what, what to say and to whom, and what to prioritise? This facilitated exercise puts your senior team through a realistic incident in a safe setting. Two experienced facilitators feed in new developments as it unfolds and press for decisions on incomplete information. Choose from four scenarios:

• Ransomware with data theft: “We can’t pay. Now what?”

• Supplier compromise

• Long-undetected intrusion

• Complex resilience incident (a cyber attack during another crisis)

5. Learning Outcomes
By the end of the day, participants will be able to:

1. Explain their own role in a serious cyber incident, who decides what, and where the organisation depends on others.

2. Make, justify and record key decisions when information is incomplete, uncertain or changing.

3. Set priorities for keeping essential services running and restoring them.

4. Identify the legal and regulatory reporting duties that apply, and their deadlines.

5. Plan communications with staff, service users, the public, the media and ministers or elected members.

6. Identify the gaps in current plans and agree prioritised improvements.

6. How to Buy
Available to public sector buyers through RM6219. Get in touch to discuss your exercise.

Effectology is an independent provider. This exercise is not endorsed or assured by the National Cyber Security Centre.