What breaks during a real crisis

Organizations that have survived significant cyber incidents describe a consistent pattern. The technical response is executed with varying competence but in a recognizable form. What consistently fails is the executive layer:

  • The timeline of critical decisions is unclear when it is needed most.
  • The information available to executives during the first twelve to twenty-four hours is partial, contradictory, and arrives through informal channels.
  • Executive communication happens reactively, under pressure, without pre-agreed messaging or decision protocols.
  • Functional coordination (legal, communications, operations, IT, risk, HR) requires significant facilitation that was not designed or practiced.

What crisis simulation actually does

A well-designed crisis simulation is not a test of technical response. It is a rehearsal of executive decision-making under realistic conditions.

  • Decision authority gaps — Who actually has the authority to make specific decisions under crisis conditions is often unclear until the simulation requires it.
  • Information flow failures — How information reaches executives during a crisis is rarely designed.
  • Regulatory clock blindness — DORA requires notification within twenty-four hours of classification. During simulation, executives discover the regulatory clock is running while they are still assessing.
  • Communication protocol gaps — What is said to whom, when, and in what form is a crisis management decision with significant legal implications.
  • Coordination friction — The most revealing moments are the small frictions: when legal and communications disagree, when the CFO needs information only the CISO has.

The methodology that works

  • Scenario realism — The scenario must be plausible, specific, and calibrated to the organization's actual risk profile.
  • Information asymmetry — Different stakeholders have different information at different times. Good simulation replicates this deliberately.
  • Regulatory clock integration — Explicit clock checkpoints: at T+4 hours, T+12, T+24.
  • Decision capture — Real-time documentation of what decisions were made, by whom, based on what information.
  • Structured debrief — Distinguish process failures, information failures, and decision quality failures.

What changes after simulation

  • Faster initial escalation. Executives who have rehearsed crisis scenarios recognize indicators earlier.
  • Better regulatory preparedness. The DORA notification timeline becomes shared organizational awareness.
  • Clearer communication protocols. Post-simulation work includes pre-agreed messaging frameworks.
  • Improved cross-functional coordination. Friction surfaces revealed in simulation are addressed through process design changes.

The regulatory dimension

Under DORA Article 26, financial entities must test their ICT continuity plans including crisis communication plans. Under NIS2 Article 21, essential and important entities must maintain crisis management capabilities.

Crisis simulation that is documented — with scenario design, participation records, decision logs, and debrief outputs — provides the evidentiary foundation that regulators are beginning to request.

A simulation exercise is not just organizational preparation. It is regulatory asset creation.