Operational teams are naturally more concerned with how specific tasks are done than management in strategic exercises. You can always use storytelling to provide context with this audience too. The challenges you pass along should probably allow for more time and attention to details, including actually solving various tasks.

For communications, this could mean writing a press release on the incident at hand. Within an IT environment, this could include e.g. writing scripts or searches for key information of interest. It could also involve getting a new kind of attack vector thrown into the mix, and you’ll need to actually find out whether the organization may be vulnerable to this.

The level of detail needed may however also be a slight risk here, in particular for IT professionals. If a key premise for the exercises is wrong, e.g. an exploited vulnerability which is not actually present in the environment, some could get caught up in arguing about that as an issue. Apart from getting such details right, setting clear ground rules for the exercise is another way to remediate this risk. Simply share very explicitly before you begin what is the purpose and desired outcome(s) of the exercise, and how should we engage with each other and the scenario at hand.

We have now engaged more than 5000 companies in preparedness exercises across events the Nordics and Baltics, and across all sectors, both public and private. While our free exercise events target small and medium sized enterprises in particular, many of the dilemmas and decisions that come up are similar to even the big ones. There are of course differences in capacity and capabilities, and definitely in terms of dependencies. The most challenging scenarios are maybe in companies which depend on operational technologies (OT). IT and OT systems exist under different priorities, and strategies for both patching, maintenance and availability with backup systems may be vastly different.

But this is the same everywhere: the existence of processes in an organization, and the assets which these processes depend on. If there is a disruption to these processes, people will need to somehow keep things going anyway. Exercising with the people who are involved in this processes, the same who are affected by disruptions, allows them to make the experience feel tailored anyway – just make sure to not lock up too many technical details in advance. This is what co-creation looks like in practice – it is not just top-down.

First of all, one can measure the exercise experience itself, and happy participants are always a joy to have during the debrief afterwards. Then, we should look at the action items which came up during the exercise – will there be any clear tasks to solve right away?

If the exercise included management, it is more likely that you’ll have support and budget available in the room already. Seeing in particular such calls to action from management is a thrill to end the session with. If they are engaged, simply let them do the talking during the debrief and use your momentum to move your efforts forward.

Finally, I think seeing actual measures being implemented is the ultimate success metric. We asked former participants about this in Denmark, six months after they had been through our national exercise scenario. We found that 48% of participating companies had implemented or improved their crisis preparedness plans, with any measures that come along as a consequence. Based on the total number of participants, that translates to thousands of companies actually taking action.