Chapter 6 of 12 · Annually
Q6: When Did We Last Practise, and What Broke?
- Do we run exercises?
- Should the board take part?
A plan that has never been practised is a guess. Exercises reveal gaps in a safe setting: missing phone numbers, unclear authority, steps nobody knew they owned.
What you should hear
- The date of the last exercise and who took part, including senior leaders.
- What went wrong. Every honest exercise finds something.
- What was changed afterwards, with owners and dates.
Red flags in the answer
- "It went perfectly." Then it was too easy, or the findings were not written down.
- Only the technical team took part.
- The same findings appear year after year.
The question you might not ask out loud
Do directors really need to join an exercise?
It helps. Board members who have rehearsed a scenario ask better questions in a real one and make decisions faster. A short tabletop with leadership once a year is a reasonable habit.
Follow-up
"What was the most uncomfortable moment in the last exercise, and what did we change because of it?"
Why this matters: in a real incident people fall back on what they have rehearsed. If senior leaders have never practised together, they will meet the hard decisions for the first time under the worst conditions.
Vary the scenario. Ransomware is common, but so are supplier breaches, insider misuse and the loss of a key cloud service. A different scenario each year tests different parts of the plan and different people.
Rule of thumb:An exercise that finds nothing was not hard enough.