To the ones who say "we do not know" in the crisis exercise

Tuesday, 9:20 am, crisis room. The exercise has been running for twenty minutes. Scenario: the file servers are encrypted, a ransom demand is on the screens. The head of the crisis team asks the room whether the backups are affected.

"No, they are safe," someone says. That has been true for years, so it will probably be true today. The next item is already on the flipchart: restore from backup, notify management, six hours.

Then a colleague from IT operations speaks up. "We do not know. The backup runs through the same directory as the file servers. Nobody has checked that yet."

What the sentence prevents

Without it, the team plans on an assumption. The promise to management, the message to customers, the order of recovery, all of it rests on "it will probably be fine". In the exercise, that costs nothing. In a real incident, the backup is encrypted too, and the six hours become three weeks after they have already been promised.

Where it is required

BSI Standard 200-4 on business continuity management describes how a crisis team keeps its situation picture. Section 5.6.2 says, in German:

„Es sollten bevorzugt gesicherte Informationen visualisiert werden. Vermutungen und Annahmen müssen als solche kenntlich gemacht werden.“

In short: preferably, confirmed information should be displayed, and suspicions and assumptions must be marked as such. The example code of conduct for crisis team work in section 5.4.1 puts it even more briefly: facts must be separated from rumours, and information must always be verified. Among the typical goals of a crisis team exercise, the standard explicitly lists reviewing the responsibilities, capabilities and knowledge of the emergency organisation. An exercise in which nobody admits a gap has missed that goal.

Why it is so hard

An exercise feels like an exam. Management is at the table, someone is taking minutes, and whoever says "we do not know" briefly looks like the person who does not have things under control. That is why the standard calls the crisis team exercise a "protected space". A space is only protected if an open gap counts as a result there, not as a failure of the person who names it.

A good exercise ends with a list of open assumptions. A bad one ends with "went well".

To them

To the ones who admit in the crisis room that they do not know something, although everyone expects an answer. And to the head of the team who writes the sentence on the board, "open" next to it, and asks someone to clarify it before the next situation briefing.

Sources

BSI Standard 200-4 Business Continuity Management, sections 5.4.1, 5.6.2 and 13.6 (German).

In the next part: to the ones who justify "not applicable" instead of ticking it. The previous part: To the ones who still report the phishing suspicion at 5:55 pm.