In the military they have a saying: ‘train hard, fight easy’. It applies just as well to crisis preparation.
Yes, an exercise matters. It tests decisions under pressure and reveals gaps that are easy to miss in a meeting room. But confidence after a successful simulation can be misleading. The real test is whether people can spot trouble early, reach the right colleagues and make sound decisions on an ordinary working day.
A cyber incident makes this especially clear. A lost device, suspicious activity on a network or a leak ahead of an announcement may begin as a technical concern. Within hours, it can become a question for employees, customers, regulators, investors and the media. The technical response and the organisation’s communications need to work together from the outset.
For organisations covered by the UK’s Network and Information Systems Regulations, serious incidents already require prompt reporting. The Cyber Security and Resilience Bill would require an initial notification within 24 hours. What a team knows, decides and records in those first hours is increasingly relevant to its regulator.
What happens between exercises?
Most organisations know they should prepare. Finding time to keep that preparation useful is harder. Teams change, contact details go out of date and a plan that worked when it was written may no longer reflect how decisions are made.
The answer is regular, manageable work between major exercises: checking escalation routes, reviewing emerging risks and making sure the people who may face an incident know one another.
Bring the right people together before you need them
A serious incident rarely stays within one team’s remit. Security, operations, legal, communications and senior leaders may all need to act quickly. They should understand who makes which decisions, what information each team needs and how they will share it securely.
That is particularly important when facts are incomplete. An organisation needs a way to act on what it knows while remaining clear about what it has yet to establish.
Keep the documents you will actually need current
Crisis plans; stakeholder maps and contact lists are only useful if people can find and trust them under pressure. They should be concise, accessible to the right people and tested against realistic scenarios.
A good plan helps a team make decisions. It cannot make those decisions for them.
Listen to the people closest to the risk
Early warning signs often appear in routine work: an unusual technical alert, a concern raised by a colleague or a pattern of questions from customers. People need to know what to escalate and feel confident that raising a concern will lead to a proportionate response.
That takes practice and a culture in which potential problems are discussed before they become public crises.
Make resilience part of everyday work
An annual exercise is a valuable test, but its greatest value lies in what happens afterwards. The findings should change how teams work, and the next exercise should test whether those changes have held.
At Muse Cyber, we bring security, risk and communications together so organisations can recognise an incident early, manage its wider consequences and explain their decisions with confidence.
