The decisions a cyber crisis forces on executives, and how to rehearse each one

Why focus on decisions rather than procedures?

Procedures can be checked on paper. Decisions cannot. In most incidents the technical team knows what to do next; the delay comes from waiting for someone with authority to accept a cost. An executive exercise earns its time by surfacing who that person is, what they need to know, and how long they take.

Which decisions come up in almost every serious incident?

1. Containment that hurts. Taking a payment platform, a factory line or a customer portal offline stops the attacker and stops revenue. Who signs that off, and at what threshold?
2. Disclosure. Public companies in the United States must consider the SEC rules adopted on 26 July 2023: a material cybersecurity incident is generally reported on Form 8-K Item 1.05 within four business days of the materiality determination. The determination itself is the decision to rehearse.
3. Regulators and supervisors. Sector rules set their own clocks and content; in the EU, NIS2 requires an early warning of a significant incident without undue delay and in any event within 24 hours. The exercise should name which regulator is told, by whom, and with what level of certainty.
4. Customers and partners. What is said, when, and through which channel, before the facts are complete.
5. Law enforcement. Whether and when to involve it, and what that changes.
6. Extortion. If data is stolen or systems are encrypted, whether to engage with the attacker at all, and who is allowed to decide.
7. Recovery order. Which systems come back first, and what the business accepts running without in the meantime.

How do you build a decision into an exercise?

Give each decision an owner in the room, a deadline in the scenario and less information than the owner would like. Make the deadline real: if the team has not decided by the time the journalist calls, the journalist writes the story without them. Record the time from first signal to decision, who was consulted and what assumption the decision rested on.

What should facilitators avoid?

• Letting the most senior person answer every question; ask the named owner first.
• Accepting "we would consult legal" as an answer; bring legal into the room or make the consultation take scenario time.
• Resolving uncertainty too early; the hardest disclosure calls are made before the forensic picture is clear.

How do you know the rehearsal worked?

Watch for three signs in the debrief. The person who owned each decision can say what information they were missing. The group can name the threshold at which it would have acted sooner. And at least one decision took longer than anyone expected, which is the finding worth fixing first. If every decision was made quickly and calmly, the scenario was probably too easy or the deadlines too generous, and the next exercise should tighten both.

Where does the technical team fit?

NIST SP 800-61 Rev. 3, published in April 2025, frames incident response as part of overall cybersecurity risk management rather than a separate technical process. In exercise terms, that means the technical lead's job in the room is to translate what is known into options and costs that executives can decide on, quickly and in plain words.