01
Design the scenario.
Attack, accident, insider threat: our consultants design situations your organisation wants to practise. Experience with actual attacks and losses informs their relevance, in light of your operations and objectives.
← Audits & assessmentsExercise,
CYBER CRISIS MANAGEMENT EXERCISES
Exercise,
exercise…
Practise decisions before a crisis.
Stelau designs, prepares and facilitates the cybersecurity side of your crisis management exercises. Scenarios grounded in reality, carefully prepared materials and facilitation that puts your teams in a position to make decisions.
01 / From scenario to control room
Realism takes preparation.
02
Write the materials.
Information messages, technical exhibits, role cards, responses and an event schedule: every item is prepared in advance. Sender, recipient, content and timing must form a credible, consistent set that the exercise controllers can use.
03
Bring the crisis to life.
On the day, Stelau works in the exercise control room. We play IT providers, user support, public-authority contacts and personnel involved, introducing cyber events and responding to participants’ decisions.
02 / Quality of preparation
Four days of crisis.
One day to practise.
A scenario can span four days, including a weekend, played out in one day. We prepare the pacing, available information and interactions, then check their consistency before the first inject.
STELAU / BEFORE THE FIRST ALERT
A credible exercise starts with preparation.
Connect the scenario to risks and decisions to practise.
Prepare messages, supporting material and simulated actors’ responses.
Distinguish crisis time from the exercise day’s timeline.
Check consistency and prepare the exercise control team.
Educational demonstration · fictional scenario. Events, actors and timings are adapted to the organisation taking part.
“EXERCISE, EXERCISE, EXERCISE”. This marker accompanies exercise communications to identify the simulation. Instructions and communication channels are agreed at the briefing.
03 / Turn practice into progress
Lessons
last beyond the exercise.
Immediately afterwards.
Gather perceptions, share observations and identify initial lessons about decisions, information sharing and coordination.
A few weeks later.
Cross-check the timeline, review reactions with perspective and identify practical improvements. Prepared materials and observations give the lessons-learned review a sound basis.
Our methodological references: ANSSI and ENISA
References for setting objectives, structuring the exercise, preparing communication and organising lessons-learned reviews.
- ANSSI / CCAOrganising a cyber crisis management exerciseObjectives, scenario, event schedule and facilitation.
- ANSSI / CDSECyber crisis: operational and strategic managementCoordinate crisis teams and decisions.
- ANSSI · 2026Anticipating and managing cyber crisis communicationPrepare messages and communication.
- ENISA · 2026The ENISA Cybersecurity Exercise MethodologyPlan, conduct and evaluate an exercise.