Incomplete information
Decide without waiting for certainty.
Establish decision criteria and thresholds before a crisis. Distinguish what is known from what still needs verifying.
Executive & Crisis Management · Leadership Readiness
MAKE THE DECISION. BEFORE TIME MAKES IT FOR YOU.
When an incident becomes a crisis, leaders must turn incomplete information into priorities, responsibilities and direction. CyberUP prepares boards, senior executives and crisis teams to manage the first hours: escalation, business continuity, Legal, Communications, stakeholders and reputation.
The Executive Problem
A crisis does not arrive with all the answers.
It brings partial signals, simultaneous pressures and decisions that cannot wait. Executive readiness clarifies who decides, with what information and with what operational consequences.
Competing priorities
Protect what matters most.
Connect containment, services, people, obligations and reputation, making the consequences of each choice explicit.
External pressure
Align the message with the action.
Coordinate leaders, Legal and Communications when stakeholders, customers and colleagues need answers.
Incident / Crisis Response
Where technical response meets decision-making.
One reference sequence connects incident response with crisis management. The exercise makes information flows and decisions between functions visible, without assigning every technical task to the leadership team.
Detect
Recognise the signal.
Technical teams detect signals. The exercise observes how relevant information reaches the designated functions.
Question to exerciseWhich signals need attention?Triage
Establish the priority.
Assess severity in relation to services, people and dependencies, without treating every alert as a business crisis.
Question to exerciseWhat could the business impact be?Investigate
Build the picture.
The decision-making picture distinguishes verified facts, hypotheses and missing information. Leaders request the updates they need.
Question to exerciseWhat do we know, and what remains uncertain?Escalate
Engage the right level.
Thresholds and responsibilities guide the involvement of the crisis team and relevant functions. Escalation follows agreed procedures.
Question to exerciseWho has the authority to decide?Contain
Direct containment.
Leaders and operational functions coordinate containment with continuity priorities, making consequences and responsibilities explicit.
Question to exerciseWhat are the consequences of the available options?Recover
Direct recovery.
The exercise examines recovery priorities, dependencies, stakeholder updates and the conditions that trigger a review of decisions.
Question to exerciseWhat conditions support a return to service?
The sequence is not a timetable. Activities can overlap, repeat and require decisions before all information is available. The involvement of leaders, Legal and Communications depends on the scenario, thresholds and procedures, not universal time windows.
Crisis Command Architecture
A decision-making structure ready before the crisis.
CyberUP exercises the decision-making structure: leadership, the crisis team, Risk, Legal, Communications and Operations. The value lies in clarifying responsibilities and dependencies before pressure builds.
Board / C-Level
Strategic direction
- Responsibilities to exercise
- Set business priorities and take decisions within the authority assigned by the organisation.
- Interface to test
- With the crisis team: identify which choices need executive approval and how the necessary information reaches decision-makers.
Crisis Team
Crisis coordination
- Responsibilities to exercise
- Maintain a shared picture, coordinate functions and make responsibilities and decisions explicit.
- Interface to test
- With leaders and operational functions: communicate priorities, updates and the consequences of decisions.
Legal / Risk
Obligations and exposure
- Responsibilities to exercise
- Assess the relevant legal and risk considerations and contribute to decisions and communications.
- Interface to test
- With the crisis team and Communications: identify the information needed to assess obligations and messages in the applicable context.
Communications
Stakeholders and trust
- Responsibilities to exercise
- Coordinate audiences, content and responsibility for messages, based on verified information.
- Interface to test
- With Legal, leaders and Operations: keep actions and communications aligned.
Operations
Continuity and recovery
- Responsibilities to exercise
- Represent essential processes and services, dependencies and the operational conditions for containment and recovery.
- Interface to test
- With Cyber/SOC/IR and IT/OT/ICS: translate technical evidence into operational options the decision-making team can evaluate.
This is a responsibility map, not an activation sequence. Authority, crisis team membership and interfaces are defined for the organisation’s context; there is no universal organisation chart.
Business Continuity Under Pressure
One decision.
Multiple responsibilities.
A cyber incident becomes a business crisis when services, obligations, people and trust compete for the same decision. Executive readiness connects technical response, operational continuity and oversight of the impact.
An essential service is degraded.
The incident’s scope is not yet confirmed.
The decision-making team must assess options without confusing assumptions with facts. The perspectives below identify questions and responsibilities to discuss, not a predetermined response.
Complementary priorities, not stages
Business Continuity
Continuity
Which processes need to keep running?
- Information to share
- Essential services, dependencies, the effects of containment and available operational alternatives.
- Responsibilities to clarify
- Who sets the priority, and who checks whether it is operationally viable?
Legal / Risk
Obligations
Which choices require legal and risk assessment?
- Information to share
- Available facts, the nature of the impact and the information each relevant function needs.
- Responsibilities to clarify
- Who assesses the applicable context, and how does their input reach the decision-makers?
Communications
Stakeholder
Who needs to be informed, how and when?
- Information to share
- Audiences, confirmed information, open questions and alignment with activities under way.
- Responsibilities to clarify
- Who approves the message, who communicates it and who provides updates?
A consistent response
Reputation
Does what we communicate match what we are doing?
- Information to share
- Alignment between operational decisions, communicated commitments and the information actually available.
- Responsibilities to clarify
- How do leaders, Legal, Communications and Operations maintain a consistent direction?
Executive Simulation
Leaders prepare by making decisions.
The scenario introduces events, partial information, external requests and consequences. The team tests its decisions and coordination as the situation develops, within the exercise’s agreed scope.
Exercise Lifecycle
How the exercise is designed and run: a cycle distinct from incident response.
Design
Define the context.Governance, roles, objectives and observation criteria are established around the organisation’s context.
Attack
Introduce the scenario.Simulated events, new information and external requests test the conditions defined for the exercise.
Respond
Make the decisions.The team interprets information, sets priorities, coordinates functions and addresses the consequences of its choices.
Control
Maintain the agreed scope.The White Team oversees the exercise and observes actions and decision-making against the objectives.
Improve
Work from the evidence.The debrief connects decisions, consequences and dependencies to identify improvement priorities.
White Team oversight runs throughout the exercise: Control does not mean oversight begins only at the fourth stage. The sequence does not prescribe universal durations.
Leadership Performance
Observe what really matters.
The aim is not simply to perform well in a simulation. It is to understand how leaders respond to the pressure of an exercise: where decisions are clear, where they stall, and which dependencies weaken the response.
Decision clarity
Clear decisions
Who decides what, under which authority and on the basis of which information.
Escalation quality
Effective escalation
How technical impact is brought to the appropriate decision-makers.
Cross-functional coordination
Aligned functions
Alignment between the crisis team, Legal, Communications and Operations.
Stakeholder management
Consistent stakeholder engagement
Consistent messages, clear responsibilities and appropriate updates.
Continuity priorities
Explicit continuity priorities
The ability to identify services that need protecting and the dependencies that matter.
Recovery governance
Directed recovery
Direction, responsibilities and conditions that support a return to service.
These are areas of observation, not scores already assigned to your organisation. Evidence is discussed in the debrief against the objectives, roles and exercise conditions.
Leadership Readiness
Prepare your
leadership team.
We build an executive exercise around your governance structure, critical processes, stakeholders and the decisions that matter in the first hours of a cyber crisis.
Board · C-Level · Crisis Team · Legal · Communications · Risk
Start with the decisions
you will need to make.
Roles, continuity priorities and interfaces between functions define the exercise. Let’s discuss the responsibilities to test and the evidence that should guide improvement.
Write to us
Email us directly or fill in the form below: we’ll get back to you.
Email us: info@cyberupinstitute.com
Your current interest: Executive & Crisis Management