BCR-01

Cyber Crisis Exercise: Immersive Training for COMEX and CIO

1

day(s)

In House

On-site

Training center

Paris

Audience

Decision-makers

Fee

On request

PRESENTATION & TARGET AUDIENCE

This training is designed for Executive Committee (COMEX) members and members of the IT Department (CIO office). It enables strategic decision-makers and operational leaders to share a common culture of cyber crisis management and to clarify each person’s role in a crisis situation. No prior technical expertise is required, as the training is designed for executives and managers.

PREREQUISITES

No technical or theoretical prerequisites are needed to attend this training.

LEARNING OBJECTIVES

The overall educational objective of this training is to experience, through simulation, the mechanisms and impacts of a cyber crisis, in order to draw the lessons needed to strengthen the organization’s crisis management process.

This training prioritizes learning by doing: most of the time is dedicated to a full-scale cyber crisis management exercise, followed by a collective effort to analyze and improve the existing framework. Theoretical content is deliberately kept concise, both upstream (framing) and downstream (structuring the action plan).

By the end of this training, participants will be able to:

  • Identify the main attack vectors that can trigger a cyber crisis;
  • Apply the principles of crisis unit management by taking on their actual decision-making role (strategic for the COMEX, technical and operational for the IT Department);
  • Analyze, based on the lived experience of the exercise, the strengths and weaknesses of the crisis management process currently in place in their organization;
  • Assess the impacts (business, financial, reputational, legal) that a comparable scenario would have generated in a real-world context;
  • Build a concrete action plan to improve their cyber crisis management process (governance, tools, roles, procedures).

TRAINING METHODS

This training is built above all on lived experience: an immersive cyber crisis management exercise, based on a realistic and evolving scenario, forms the core of the day. An initial framing session establishes the essential vocabulary and reference points; a collaborative lessons-learned workshop (after-action review), at the end of the day and 3 months later, enables participants to turn the practical exercise into concrete lessons that are directly applicable to their own crisis management process.

ASSESSMENT METHOD

Effective mastery of all the learning objectives will be verified through a quiz (summative assessment).

PROGRAMME

Sequence I. Cyber crisis: a full-scale simulation exercise

  • Presentation of the scenario, roles and rules of engagement (COMEX in the strategic crisis unit, IT Department in the operational crisis unit)
  • Running the exercise: escalation of the attack, successive injects, decisions to be made under time pressure
  • Exposure to the real impacts of a cyber crisis: loss of resources, media pressure, uncertainty, business versus technical trade-offs
  • Coordination between strategic steering (COMEX) and technical response (IT Department) under pressure

Sequence II. Turning the exercise experience into improvements to the crisis management process

  • “Hot” debriefing: what happened, what was difficult, what was missing
  • Collective analysis of the observed impacts (business, financial, reputational, legal) and what they reveal about current vulnerabilities
  • Comparison between the crisis framework mobilized during the exercise and the process actually in place within the organization
  • Collaborative workshop: identification and prioritization of areas for improvement in the crisis management process
  • Construction of a concrete action plan (governance, roles, tools, upcoming drills) to be presented to the COMEX

Sequence III. “Cold” debriefing: consolidating the action plan (at 3 months)

  • Additional collection of observations from participants
  • In-depth analysis across key themes: crisis governance and processes, communication, decision-making and action tracking, technical and operational capabilities, interactions between teams and with external stakeholders
  • Drafting of a structured summary: findings, strengths to maintain, areas for improvement
  • Presentation of the consolidated and prioritized action plan to the COMEX, with milestones, owners and deadlines
  • Definition of the upcoming training plan (frequency, increasing scenario complexity, extended scope)

Updated on 3 July 2026

Training Center

PARIS
121 rue d'Aguesseau (centre d'affaires Emergence)
92 100 Boulogne Billancourt

Registered under number: 11922630392.

Request a quote
Cybersecurity training, NIS2, DORA.

Meets the training requirements of both NIS2 and DORA

Whether you fall under NIS2 or DORA, the principle is the same. Article 20 of NIS2 requires executives to be trained on cyber risk. Article 5 of DORA sets an equivalent requirement for ICT risk. This exercise meets that obligation through hands-on practice. It produces a documented report, usable during an audit or regulatory review.

A key component of a comprehensive solution :

  • Full NIS2 training programme : from executive training to organisation-wide staff awareness, including IT teams and phishing simulation campaigns.
  • Full DORA training programme : from executive training to organisation-wide staff awareness, including IT teams and phishing simulation campaigns.
  • Third-party risk management : mapping your suppliers and providers, scoring their criticality, and securing your supply chain contractually.
  • CISO as a Service: ongoing strategic security guidance, without an in-house recruitment.
Talk to an expert