[CM] Definition of an Incident Crisis Management Live Exercise

Definition of a Live Incident Crisis Management Exercise

An Incident CM Live Exercise is a real-time, immersive simulation replicating a specific crisis scenario (e.g., cyberattack, fire, product recall) with physical deployments, operational actions, and live decision-making—not just theoretical discussions.

Unlike tabletop exercise, participants must execute actual procedures (e.g., evacuations, IT system failovers, press briefings) under time pressure, closely mimicking a real incident.

Pre-reading for Participants Attending Module 4 of the CM-5000 Crisis Management Expert Implementer Course

Key Characteristics

1. Real-World Execution

   • Participants physically perform tasks (e.g., activating emergency ops centres, deploying backup systems, conducting mock media interviews).

   • Example: IT teams isolate servers during a simulated ransomware attack.

   
   
   

2. Focused on a Single Incident Type

   • Tests one high-risk scenario (e.g., active shooter, data breach, power outage) to refine specialised response protocols.

   
   
   

3. Time-Pressured Environment

   • Runs in real-time (e.g., a 1-hour exercise mirrors 1 hour of crisis response).

   • Introduces unplanned injects (e.g., "Employees are trapped in Building B") to test adaptability.

4. Multi-Team Coordination

   • Engages only relevant teams (e.g., IT and security for a cyber incident, and facilities and HR for a workplace evacuation).

Purpose & Objectives

• Validate procedural muscle memory (e.g., can teams follow checklists under stress?).

• Test technology/tools (e.g., do mass notification systems work?).

• Identify operational gaps (e.g., evacuation routes are blocked).

• Build confidence through hands-on practice.

How It Differs from Other Exercises

Example: Active Shooter Live Exercise

Scenario

Gunman reported in Office 3B.

Live Actions Tested

• Security teams physically sweep rooms using protocol.

• HR activates employee accountability tools.

• PR drafts a real statement within 15 minutes.

• Employees practice lockdown procedures.

Injects

1. "Shooter moves to Floor 2."

2. "Fake 911 call claims hostages."

Outcome Metrics

• Response Time: How quickly were critical actions taken?

• Tool Reliability: Did emergency systems (e.g., alarms, apps) function?

• Human Behaviour: Did staff panic or follow training?

Incident live exercises are critical for high-stakes, high-speed scenarios (e.g., fires, cyberattacks).