A crisis exercise can run smoothly, finish on time and leave everyone satisfied… without having tested anything. What matters is not apparent success, but what the exercise reveals about the organisation’s real ability to understand, coordinate and decide.
This article is for crisis management and business continuity managers, and for SME leaders running their first exercises. The examples are fictional. The methodological points attributed to ANSSI, the French National Cybersecurity Agency, come from its publications, listed in the sources.
A reminder: what an exercise should achieve
ANSSI and the Club de la continuité d’activité (French business continuity association) define an exercise as the simulation of a scenario: a sequence of fictional events that creates a realistic but not real crisis situation. Their guide structures the approach around a few key steps: setting objectives, choosing the format, building the master events list, observing, then drawing lessons through a lessons-learned review. The seven mistakes below each reflect a weakness in one of these steps.
Mistake 1: running an exercise without clear objectives
Fictional example
A logistics SME decides to “do a cyber exercise this year”. Nobody states what needs to be tested. On the day, the exercise control team sends out messages without knowing which ones really matter.
Consequences
Without objectives, there is no way to tell whether the exercise succeeded. The debrief turns into an exchange of impressions and no improvement decisions come out of it.
Correction
Set two to four observable objectives, for example: the crisis team is convened within a defined time, a first situation report is produced, management approves an external message. In ANSSI’s method, each inject in the master events list is linked to one or more objectives. Remove any inject that serves none.
Debrief question
For each of our objectives, what did we observe that tells us whether it was achieved?
Mistake 2: choosing a scenario that does not match the team’s maturity
Fictional example
A crisis team that has never met faces a multi-site attack with a data leak, media pressure and foreign counterparts. After an hour, participants disengage.
Consequences
An overly complex scenario overwhelms participants; an overly simple one tests nothing. Either way, the lessons are weak.
Correction
Match the format to the level of preparedness. ANSSI, for example, offers exercise kits in three levels according to maturity: tabletop exercise, simulation, then advanced simulation. It also provides a self-assessment tool to determine that level.
Debrief question
At what point was the exercise too easy, or too hard, to be useful?
Mistake 3: letting players know the scenario
Fictional example
To “reassure” management, the organiser sends them the full storyline the day before. The next day, decisions come very quickly, with suspicious precision.
Consequences
The exercise no longer tests the ability to analyse an uncertain situation, but memory. The response times measured are distorted.
Correction
Announce the framework (date, duration, rules of play, general objectives) without revealing the scenario. Keep the detailed content for the exercise control team and the observers.
Debrief question
What information would we have wanted earlier, and through which channel should it have reached us?
Mistake 4: simulating a crisis without realistic pressure
Fictional example
All events arrive by email, at regular fifteen-minute intervals. No calls, no outside requests: participants have time to read and discuss everything.
Consequences
The exercise ignores what makes a crisis hard: contradictory information, simultaneous demands, pressing external requests. The crisis team appears more effective than it would be.
Correction
Vary the channels and senders. ANSSI provides for injects to come from internal actors, such as a department manager, or external ones, such as a journalist. Vary the pace: quiet phases, then several requests at once.
Debrief question
When several requests arrived at the same time, how did we decide what came first?
Mistake 5: not having the real decision-makers take part
Fictional example
The managing director, held up by a client meeting, sends their assistant, who has no authority to decide. Key decisions remain pending until the end.
Consequences
The exercise does not test the real chain of command. The blockages observed come from how the exercise was organised, not from how the crisis would be handled.
Correction
Book the date early with decision-makers. If a role holder is absent, have their official deputy play: that is also a useful test of the arrangements.
Debrief question
Who actually had the authority to make each key decision, and were they in the room?
Mistake 6: running the exercise without observing it
Fictional example
Two people handle the exercise control alone. Busy sending messages and making simulated calls, they record almost nothing of what happens in the crisis team.
Consequences
The debrief relies on participants’ memories. Response times, information flows and bottlenecks go undocumented.
Correction
Separate the exercise control and observation roles. ANSSI’s guide includes a practical sheet on observation, and the exercise specification of its Paris 2024 Olympic and Paralympic Games kit provides for at least one observer per crisis team. Give observers a grid linked to the objectives.
Debrief question
What did the observers record that participants had not noticed?
Mistake 7: reducing the lessons-learned review to a round-table
Fictional example
At the end of the exercise, everyone shares how they felt, congratulations go round and people leave. Three months later, nobody can find a written report.
Consequences
The lessons fade away. The next exercise repeats the same difficulties.
Correction
Separate two stages, as ANSSI recommends: a hot debrief immediately after the exercise, then a cold debrief within the following month, supported by a participant questionnaire. Conclude with an action plan with owners and deadlines.
Debrief question
Which three actions are we committing to, who owns them and by when?
Preparation checklist
- Two to four observable objectives are written and approved by management.
- The format matches the team’s level of maturity.
- The scenario remains confidential; only the framework is shared with participants.
- Each inject in the master events list is linked to an objective.
- Injects vary by channel, sender and pace, including external requests.
- The designated decision-makers, or their official deputies, have confirmed attendance.
- Exercise control and observation roles are separate.
- Each crisis team has at least one observer, with a grid linked to the objectives.
- The opening briefing is ready: objectives, duration, rules of play.
- The hot and cold debriefs are scheduled, along with the owner of the action plan.
From checklist to exercise
A useful action: take your last exercise and compare it with these seven mistakes. The ones you recognise show where to start for the next one.
The Exerce-Ease platform supports each of these steps: designing the scenario and objectives, building the master events list, sending varied injects (emails, SMS, calls, media), observing decisions and preparing the lessons-learned review.
Discover the platform: https://www.exerce-ease.com/en/plateforme.php