Disaster Recovery Journal Winter 2024

The Art of Realistic, Believable Exercise Scenarios

S

By MARK CARROLL

World events provide an extensive backdrop of opportunity for defining the actual scenario. Under the umbrella of “you can’t make this stuff up” the real world leaves us with rich inventory; a host of situations we can adapt in formulating our tabletop. It’s right there at our fingertips. A firm in Europe impacted by an earthquake while employees were picketing, or an office with a gas leak, resulting in evacuation at the same time as a water main break in front of the building, or a hazardous spill simultaneous with a ransomware event. The list is endless and, sadly, it is com pletely off-the-table for your use or deployment! Why? Well, while reality may portray the inconceivable or implausi ble, your scenario needs to be somewhat realistic and believable. The fact is the old saying, “Life imitates art more than art imi tates life,” is true. Reality can be extreme, but painting examples of extreme situations or conditions as fodder for a tabletop may be handily dismissed by those involved. We can live through the ridiculous, but planning for and using the ridiculous in a tabletop is another story. You’ve been repeating for years, “You can’t make this stuff up because it is not credible.” Take your own advice! Reality trumps. I don’t have to be convinced, believe, or have faith in the gas leak/water main break situation because it is known, documented, actually happened, maybe even to me. It does not have to be evaluated as credible because it is already there by virtue of the fact it took place. It is the real world and a true confirmed known, not a held belief. There is a clear differ ence. The scenario you put forward most likely does not have that factual actuality for your organization, so needs to be viable or believable, especially when those engaged are evaluating in their heads whether it is possible, worth their time, and the discus sion of which would benefit from their active engagement. That crazy complexity you can find or prove is, no doubt, factual, but restricted to the real world. It is out of bounds for your exercise. Sounds crazy but it’s true. So, how do you proceed? The manifestations of the issues posed may and probably need to be diverse to engage all parties, but they need to start with the

uddenly (or not so suddenly) it is that time of the year; the time for you to start to plan the annual senior management tabletop exercise. That’s the four- to eight-hour event where folks at the C-level assemble and wrestle a firm-wide crisis to the ground. Not a simple task, as it includes a host of individual details and the complex ity of scheduling a group of diverse folks with demanding calendars and commitments. Developing an exercise scenario involving

this level of management is itself a major undertaking. It entails formulating a situation to engage all parties continuously over an extended period of time. This may be a cyber event that focuses on IT security but engages HR, finance, or an employee strike that puts the spotlight on physical security but requires the involve ment of audit, health and safety. The options are endless, but the choice needs to ensure everyone at the table has an active role; a true challenge in contributing to and orchestrating an effective exercise. Development of that scenario needs to both include and pre clude history. Huh? The actual event needs to be fresh and not even close to a rinse and repeat from last year or any prior years. What you did in the past as either a subject area or approach is totally out of bounds; precluded outright. Management will not appreciate covering material from a prior exercise and will not respect the work you have done on this exercise if it even leverages what has been done in the past. However, what you surfaced and learned in those events needs to be considered as acted on and resolved. The situation(s) of the past may not be relevant to the new scenario you develop but the learnings and actions could cross over and need to be confirmed as closed out as you move forward. It may even be worth refer encing those advancements or successes as a source of past acco lades in anticipation of similar success in the current event. Even senior management will accept applause (or is that “especially” senior management?).

DISASTER RECOVERY JOURNAL | WINTER 2024 9