[CM] Definition of a Live Crisis Management Exercise

Definition of a Live Crisis Management Exercise

A Live Crisis Management Exercise is a realistic, real-time simulation where participants physically enact crisis response procedures as if the event were occurring.

It involves hands-on execution of tasks, tools, and protocols under pressure to test operational readiness, decision-making, and coordination in a controlled but immersive environment.

Pre-reading for Participants Attending Module 4 of the CM-5000 Crisis Management Expert Implementer Course

Key Characteristics

1. Real-World Actions

   • Participants perform tangible tasks (e.g., evacuating a building, isolating IT systems, conducting mock press briefings).

   • Example: Security teams physically sweep a facility during an active shooter drill.

2. Time-Pressured Environment

   • Runs in real-time (e.g., a 1-hour exercise simulates 1 hour of crisis response).

   • Includes unplanned injects (e.g., "A fire spreads to the backup server room") to test adaptability.

3. Multi-Team Coordination

   • Engages relevant teams (e.g., IT, PR, Operations) and sometimes external partners (e.g., emergency responders, vendors).

4. Technology & Tool Testing

   • Validates real systems (e.g., emergency alarms, mass notification tools, backup generators).

Purpose & Objectives

• Validate procedural execution: Can teams follow checklists under stress?

• Test tool reliability: Do emergency systems function as intended?

• Identify operational gaps: Are evacuation routes blocked? Is the equipment accessible?

• Build muscle memory: Reinforce training through hands-on practice.

How It Differs from Other Exercises

Example Scenario: Live Cyberattack Exercise

Objective

Test IT and PR coordination during a ransomware attack.

Live Actions

• IT teams physically disconnect infected servers from the network.

• PR drafts and delivers a mock press statement within 30 minutes.

• Executives role-play negotiations with "hackers" (facilitators).

Injects

1. T+0: Ransom note appears on all workstations.

2. T+20 mins: Fake social media posts claim customer data was leaked.

3. T+1 hour: Regulators demand a compliance report.

Outcome Evaluation

• Response Time: How quickly were critical actions taken (e.g., isolating systems)?

• Tool Effectiveness: Did mass notification systems reach all employees?

• Human Behaviour: Did staff panic, or follow protocols?

When to Use a Live Exercise

• High-risk scenarios requiring muscle memory (e.g., fire drills, active shooter response).

• Testing new tools/procedures (e.g., launching a crisis communication app).

• Preparing for audits or regulatory compliance (e.g., financial sector stress tests).