Board Cyber Crisis Programme

A focused, board-level workshop that gives participants the essential context they need before entering the simulation. This session is designed for senior, non-technical leaders and covers:

Outcome:
Participants understand their role in a cyber crisis and are ready to apply that knowledge in a realistic exercise.

This exercise is based on the simulation of a realistic cyber crisis scenario. The scenario is designed around your specific organisation, sector, operating model, risk profile and leadership structure.

This is not an off-the-shelf exercise. We develop a tailored case study based on the kinds of incidents that could realistically affect your organisation.

The case study can include, for example:

During the tabletop, board members will be asked to respond to evolving information and make decisions. They are also encouraged to challenge assumptions and work together under realistic time pressure.

Outcome:
Your board gains practical experience in leading a cyber crisis. They are able to identify where decision-making, governance, escalation or communication processes need strengthening.

Cyber crises often become public before organisations are ready.

The media simulation tests how your leadership team would respond to external scrutiny, fast-moving narratives and difficult questions.

This can include:

- Simulated journalist enquiries
- Breaking news scenarios
- Social media escalation
- Customer and stakeholder pressure
- Draft holding statements
- Press conference preparation
- Testing spokesperson confidence and message discipline

Outcome:
Your leaders understand how to protect trust, avoid speculation and communicate facts responsibly. Most importantly, they practise how to maintain confidence during a high-pressure media environment.

A cyber crisis can trigger urgent regulatory obligations and external reporting expectations.

The regulatory simulation helps your board and executive team practise how they would respond to regulator interest, notification requirements and governance scrutiny.

The simulation can be tailored to your sector and may include:
- Simulated regulator enquiries
- Breach notification decision points
- Information requests
- Evidence of board oversight
- Governance and accountability questions
- Legal and compliance escalation
- Coordination between the board, legal, security, risk and communications teams

Outcome:
Your leadership team gains a clearer understanding of regulatory expectations and how to demonstrate calm, structured and accountable decision-making.

In a cyber crisis, the quality of communication can determine whether stakeholders stay confident or lose trust. This coaching element helps senior leaders communicate clearly with internal and external audiences.

We focus on:

- Board-level messaging
- CEO and chair communications
- Internal staff updates
- Customer and client communications
- Investor or funder messaging
- Media statements
- Creating pre-approved communications templates 
- Regulator-facing communications
- Avoiding over-reassurance, under-disclosure and inconsistent messaging

Outcome:
Your board and executive team leave with stronger communication instincts and a clearer approach to stakeholder reassurance.

A facilitated debrief to capture lessons, strengths, weaknesses and improvement priorities.

Focus areas:
- What worked well
- Where decision-making slowed down
- Where roles were unclear
- Communication gaps
- Regulatory readiness gaps
- Priority actions
- Next steps for improvement

The Board Cyber Crisis Programme is a high-impact, board-level programme from Cyber Management Alliance that prepares boards and executive leadership teams to lead their organisation through a major cyber crisis. Through a tailored executive workshop and realistic, professionally facilitated simulations — including a board tabletop exercise, media simulation and regulatory simulation — it tests executive decision-making, crisis communications and regulatory response in a safe environment, before a real incident happens. It is deliberately non-technical and focused on governance, leadership and strategic decisions.

A major cyber attack is now a board-level business crisis, not just a technical incident — it can affect operations, regulatory confidence, share value and leadership credibility. When an incident escalates, the board must make fast, difficult and highly visible decisions: who declares a crisis, who speaks to regulators, and what to tell customers, employees, investors and the media. Many organisations have technical incident response plans but have never tested whether their board can lead through the regulatory and communications consequences of an attack. This programme closes that gap and builds the ‘muscle memory’ senior leaders need when every decision is time-sensitive and consequential.

No. The programme is designed for boards, executives and senior leaders. It focuses on governance, decision-making, escalation, stakeholder communication and crisis leadership rather than technical detail or jargon.

The programme is designed for board members, chairs and non-executive directors, CEOs and managing directors, and executive leadership teams, along with general counsel and legal leaders, risk, compliance and governance leaders, communications and public affairs leaders, CIOs, CISOs and technology leaders, and HR and operations leaders. It is especially valuable for organisations operating in regulated, high-trust, public-facing or operationally critical environments.

The programme is built around six components: (1) an Executive Cyber Crisis Workshop that briefs leaders on their role before, during and after an incident; (2) a Tailored Board Tabletop Exercise based on a realistic, organisation-specific scenario; (3) a Media Simulation testing the response to journalist enquiries, breaking news and social media pressure; (4) a Regulatory Simulation covering regulator enquiries, breach-notification decisions and evidence of board oversight; (5) Crisis Communications Coaching on board, CEO and stakeholder messaging; and (6) a facilitated Debrief and Recommendations. You also receive a Cyber Crisis Decision-Making Framework, an executive summary report and a priority action plan.

A standard tabletop exercise or executive briefing typically tests one dimension — usually the incident-response decisions or general awareness. The Board Cyber Crisis Programme is broader: it combines cyber incident response, board governance, regulatory accountability, media pressure, stakeholder trust and crisis leadership in a single, integrated board-level experience. As well as the tabletop, it adds dedicated media and regulatory simulations and crisis-communications coaching, so the board practises the full range of pressures a real cyber crisis creates, not just the technical response.

Yes. Every programme includes a bespoke case study — not an off-the-shelf simulation — designed around your sector, operating model, risk profile, stakeholders and likely cyber crisis scenarios. Before the session we gather relevant context such as your business-critical services, existing crisis and incident response plans, regulatory considerations and board structure. Scenarios can include ransomware affecting critical operations, a data breach involving customer or employee records, supply chain compromise, insider threat, cloud or SaaS platform compromise, an attack on public-facing services, or a cyber incident during a high-profile or politically sensitive event.

Yes. Where appropriate, the exercise can be designed to test your existing cyber incident response, crisis management, communications and escalation arrangements, revealing where decision-making, governance or coordination need strengthening.

The programme includes a dedicated regulatory simulation in which the board practises responding to regulator enquiries, breach-notification decision points, information requests and governance scrutiny. It helps leaders understand what evidence, decisions and actions may matter during regulatory scrutiny, and how to demonstrate calm, structured and accountable decision-making — strengthening the board’s ability to evidence effective governance after an incident.

The programme is flexible and can be delivered as a half-day, full-day or modular board development experience; a typical full-day format runs as six sessions covering the workshop, tabletop, media simulation, regulatory simulation, communications coaching and debrief. It can be delivered onsite, virtually or in a hybrid format to suit your board and executive team.

You receive a structured debrief, an executive summary report, key observations and recommendations, and a priority action plan to strengthen board cyber crisis readiness. Each programme also includes the tailored case study, workshop materials, the media and regulatory simulation injects, and a Cyber Crisis Decision-Making Framework.

Cyber Management Alliance is a global cybersecurity training and consultancy provider with deep experience in cyber incident response, executive training, crisis management and tabletop exercises. The programme is board-level and non-technical, built around realistic, organisation-specific scenarios, fully interactive, and integrated across cyber, media, regulatory and communications pressure — with an outcome focus that produces practical recommendations and next steps. Cyber Management Alliance has supported organisations including FIFA, NHS, Capita, BNP Paribas, Formula 1 and the British Medical Journal.