A tabletop ends with minutes, a simulation game with a decision
A classic tabletop lives on moderation and ends with minutes. A simulation game forces a decision: every important inject confronts the team with two to four alternatives, every alternative has points and a consequence, and the clock is running. The points make visible where the organisation is strong and where not, comparable across teams and repetitions. Every session is a BCM exercise and counts as such for ISO 22301, BSI Standard 200-4 and NIS2. The scorecard rates five dimensions: detection, containment, communication, reporting duties, recovery.
Ransomware in the ERP environment with recovery from an 18-hour-old backup, CEO fraud over 480,000 euros with a forwarding rule in the mailbox, insider, data breach with media, supply chain and patch rollback, long-term attack. With difficulty level, as system templates, plus the tenant’s own scenarios.
The scorecard asks not only whether the incident was detected and contained, but whether the deadlines under GDPR, NIS2, classified information protection and contract were recognised and met. Whoever forgets the 24 hours loses points, even if the technology ran cleanly.
From the after-action report a 30/60/90-day plan arises with handover to BCM CAPA and tasks. Exercise series with rising complexity show whether the next session goes better than the last.
A crisis team that has decided under time pressure and seen the consequence, instead of a team that has read a scenario.
Schedule a no-obligation demo – we will show you the module with your own use cases.
