Running a crisis exercise is not enough to train a team. What makes the difference is how the exercise is designed, played, observed and then followed up. This article sets out the principles of effective training, then how Exerce-Ease solutions help you put them into practice, depending on the size and maturity of your organisation.
The principles draw on the ANSSI (French National Cybersecurity Agency) and SGDSN (French General Secretariat for Defence and National Security) publications cited at the end of the article. The solutions described are those offered by Exerce-Ease.
The principles of good training
1. Start from your real risks
A useful exercise puts the team in front of situations that could really affect it: a cyberattack, an incident on site, a supplier failure, a reputational crisis. A generic scenario trains generic reflexes. Before choosing a scenario, you therefore need to know your essential activities, your dependencies and the consequences of an interruption.
2. Set observable objectives
Each exercise should answer a specific question: does the crisis team convene quickly enough? Does information flow? Are decisions made and recorded? In ANSSI’s method, each inject in the master events list is linked to one or more objectives.
3. Match the level to the team’s maturity
A beginner team makes more progress with a tabletop exercise than with a complex simulation. ANSSI offers its exercise kits in three levels: tabletop exercise, simulation, then advanced simulation. Difficulty should increase with experience.
4. Recreate realistic pressure
A crisis is experienced through requests that arrive quickly, through several channels and sometimes all at once: internal messages, customer calls, questions from journalists, contradictory technical information. A good exercise recreates this pressure in a controlled way.
5. Observe in order to learn
Without structured observation, the debrief relies on impressions. Observers who record response times, information flows and decisions give the lessons-learned review a factual basis.
6. Turn lessons learned into actions
ANSSI recommends a hot debrief immediately after the exercise, then a cold debrief within the following month. Findings should lead to an action plan with owners and deadlines.
7. Train regularly
A one-off exercise does not build lasting reflexes. SGDSN points out that exercises are used to check that arrangements and procedures are known, understood and workable within the planned timeframes. This check needs to be repeated as the organisation, its teams and its risks change.
For the pitfalls to avoid, see also our article “Crisis exercise: 7 mistakes that stop you from really testing your organisation”: https://www.exerce-ease.com/publication.php?slug=crisis-exercise-7-mistakes
How Exerce-Ease puts these principles into practice
Exerce-Ease offers several complementary solutions, from the initial risk assessment through to regular, self-run training.
The resilience assessment for SMEs
For an SME, the right starting point is not necessarily software. The resilience assessment helps you understand your risks, your dependencies and the consequences of an interruption, and delivers a prioritised action plan. This is the foundation for building exercises based on your real risks.
Three levels are available, with scope and price agreed before the work begins:
- Express assessment, for companies with 10 to 30 employees: €1,490 excl. VAT, half a day, a summary report and 10 priority recommendations.
- Full assessment, for companies with 31 to 200 employees: €3,900 excl. VAT, two days on site, risk mapping, analysis of critical dependencies and a prioritised six-month action plan.
- Premium assessment, for high-stakes or multi-site organisations: from €6,900 excl. VAT, including a leadership workshop, a short-format crisis exercise, a simplified business continuity plan and a 12-month roadmap.
Prices are fixed fees, excluding travel expenses.
Exerce-Ease Studio: prepare and run your exercises simply
Exerce-Ease Studio is a workspace designed for facilitators, lighter than the full platform. It is aimed at trainers, consultants and internal facilitators, and supports every stage of the exercise.
- Before the session: build the timeline around the skills you want to practise, define the recipient and expected response for each event, prepare participants and their roles, and keep reusable timelines in a library. An exercise prepared with the design tool provided by Exerce-Ease loads into Studio and can be run straight away.
- During the session: participants log in and receive the events intended for them. The facilitator controls the pace, can freeze automatic event triggering, send or skip an event, introduce a live inject and record observations.
- After the session: each exercise is retained with its timeline, participants, events and exchanges. Reports, available across several years and exportable, support the debrief and help track the team’s progress.
Studio thus puts several of the principles above into practice: events linked to a purpose, pressure adjusted in real time, recorded observations, a lessons-learned review based on what actually happened, and training sessions that are easy to repeat.
Find out more about Exerce-Ease Studio: https://www.exerce-ease.com/en/exerce-ease-studio.php
The Exerce-Ease platform: the complete solution
The platform covers the full exercise cycle:
- design the scenario, objectives, participants and simulated roles;
- build the master events list and schedule every inject: emails, SMS, calls, media content;
- run the exercise and adjust the pace to the reactions observed, on site or remotely;
- observe response times, information flows, decisions and bottlenecks;
- prepare the lessons-learned review and build an improvement plan.
For large organisations, the platform can be deployed on a dedicated VPS and configured to match their procedures, roles and governance.
Support: expertise when you need it
The solutions can be used independently or with support. Exerce-Ease can help with scoping, scenario design, configuration, running the exercise and the lessons-learned review. This expertise draws on the background of its founder, Bertrand Gille, who held crisis management and business continuity responsibilities at Sanofi, among other roles, according to the profile published on the company’s website.
Which solution for which need?
- You run an SME and do not know where to start: the resilience assessment.
- You are a trainer, consultant or internal facilitator and want to prepare and run exercises simply and often: Exerce-Ease Studio.
- You want to design, run and analyse complete, multi-channel simulations yourself: the Exerce-Ease platform.
- You want help preparing or running an exercise: support, on its own or combined with one of the tools.
Checklist before your next training session
- Your risks and critical dependencies are identified.
- The exercise has two to four observable objectives.
- The format matches the team’s level.
- Injects vary by channel, sender and pace.
- Observers are planned, with a grid linked to the objectives.
- A hot and a cold debrief are scheduled.
- The next training session is already in the calendar.
Take action
A useful action: find the situation in the list above that matches yours, then set a date for your next training session.
To discover Exerce-Ease solutions in your context: https://www.exerce-ease.com/en/contact.php