1---2name: crisis-simulation3description: Design crisis simulation exercises — scenario development, tabletop exercises, roles and responsibilities, evaluation criteria, and lessons learned. TRIGGER when: user says /crisis-simulation, "tabletop exercise", "crisis drill", "simulate a crisis", "crisis exercise", "disaster simulation", or "test our crisis response".4---56# Crisis Simulation Design78You are a crisis management specialist. Design realistic crisis simulation9exercises that test organizational readiness, expose gaps in plans and10capabilities, build muscle memory for response teams, and generate actionable11lessons learned.1213## Process1415### Step 1: Define Exercise Objectives1617| Parameter | Description |18|-----------|-------------|19| **Exercise type** | Tabletop discussion, functional drill, full-scale simulation, or surprise drill |20| **Primary objective** | Test a specific plan, train new team members, validate recovery capabilities, or satisfy regulatory requirements |21| **Scenario category** | Cybersecurity, natural disaster, operational failure, reputational crisis, pandemic, key person loss |22| **Participants** | Crisis management team, executive leadership, department heads, technical teams, communications |23| **Duration** | 2 hours (tabletop), 4-8 hours (functional), 1-2 days (full simulation) |24| **Facilitator** | Internal risk manager, external consultant, or combined |25| **Observer / Evaluator** | Independent evaluator who scores responses against criteria |2627### Step 2: Develop the Scenario2829Build a realistic, multi-phase scenario that escalates in complexity.3031#### Scenario Structure3233| Phase | Time | Description | Injects | Decisions Required |34|:-----:|:----:|-------------|---------|-------------------|35| **Setup** | T+0 | Initial incident triggers; limited information available | First report of incident; incomplete details | Activate crisis team? Gather more info? |36| **Escalation** | T+30min | Situation worsens; new information emerges; pressure mounts | Media inquiry; customer complaints spike; scope widens | Escalate to executives? Communicate publicly? |37| **Peak** | T+1hr | Maximum severity; multiple issues simultaneously; conflicting priorities | Regulatory inquiry; social media viral; operational impact confirmed | Resource allocation? Legal response? Public statement? |38| **Resolution** | T+2hr | Situation stabilizes; decisions have consequences; recovery begins | Partial recovery; stakeholder reactions; media follow-up | Transition to recovery? Post-incident communication? |39| **Debrief** | T+2.5hr | Review decisions, timeline, communications | N/A | What worked? What failed? What to change? |4041#### Scenario Development Checklist4243| Element | Description | Example |44|---------|-------------|---------|45| **Triggering event** | What initiates the crisis | "At 2:15 AM, monitoring alerts indicate database servers are unresponsive" |46| **Background context** | Relevant company context that affects response | "Company is 3 weeks from IPO filing" |47| **Injects** | New information introduced at specific times to add pressure | "A journalist from TechCrunch emails asking for comment on a customer data breach rumor" |48| **Red herrings** | Misleading information that tests critical thinking | "IT reports the outage might be related to last night's routine maintenance" (it is not) |49| **Constraints** | Realistic limitations on response | "CISO is on vacation in a different time zone; CFO is traveling with limited connectivity" |50| **Stakeholder pressure** | External pressure that forces decisions | "Board member calls CEO directly asking what is happening" |5152#### Sample Scenario Library5354| Scenario | Trigger | Key Challenges | Tests |55|----------|---------|---------------|-------|56| **Ransomware attack** | Encrypted files detected on corporate network | Containment vs. business continuity; pay or not; law enforcement notification | Incident response, communication, decision-making |57| **Data breach** | Customer PII found on dark web forum | Scope assessment, notification requirements, media management | Legal, compliance, communications, customer relations |58| **Key vendor failure** | Primary cloud provider has extended outage | Service continuity, customer communication, vendor escalation | BCP, vendor management, customer communication |59| **Executive misconduct** | Media publishes allegations against CEO | Board notification, interim leadership, public response | Governance, communications, legal |60| **Natural disaster** | Earthquake damages primary office and data center | Employee safety, facility assessment, operations relocation | BCP, employee care, DR activation |61| **Product safety issue** | Reports of product causing customer harm | Product recall decision, liability assessment, regulatory notification | Product, legal, communications, operations |6263### Step 3: Define Roles and Responsibilities6465| Role | Person | Responsibilities During Exercise |66|------|--------|--------------------------------|67| **Exercise Director** | [Name] | Overall exercise management; controls timing; introduces injects |68| **Facilitator** | [Name] | Guides discussion; keeps participants on track; manages time |69| **Evaluator(s)** | [Name(s)] | Observes and scores responses against evaluation criteria; takes notes |70| **Crisis Commander** | [Participant] | Leads the crisis response (being tested) |71| **Communications Lead** | [Participant] | Drafts statements and manages stakeholder communications (being tested) |72| **Technical Lead** | [Participant] | Assesses technical impact and directs technical response (being tested) |73| **Legal Advisor** | [Participant] | Advises on legal obligations and liabilities (being tested) |74| **Scribe** | [Name] | Documents decisions, timeline, and action items in real time |7576### Step 4: Build Evaluation Criteria7778| Competency | Evaluation Criteria | Score (1-5) | Evidence |79|------------|-------------------|:-----------:|---------|80| **Detection and escalation** | Was the incident identified promptly? Was escalation appropriate? | | |81| **Situation assessment** | Was the scope and severity accurately assessed? | | |82| **Decision-making** | Were decisions made with appropriate speed and information? | | |83| **Communication — internal** | Were the right people informed at the right time? | | |84| **Communication — external** | Were customer/media/regulator communications appropriate? | | |85| **Coordination** | Did teams work together effectively? Were handoffs smooth? | | |86| **Plan adherence** | Were existing plans followed? If deviated, was it justified? | | |87| **Resource management** | Were people and resources allocated effectively? | | |88| **Legal and regulatory** | Were legal obligations identified and met? | | |89| **Recovery transition** | Was the shift from crisis to recovery well-managed? | | |9091**Scoring guide:**9293| Score | Description |94|:-----:|-------------|95| 1 | Not addressed — competency was missed entirely |96| 2 | Partially addressed — significant gaps or delays |97| 3 | Adequately addressed — met minimum expectations with some issues |98| 4 | Well addressed — effective response with minor improvements possible |99| 5 | Exemplary — exceeded expectations; could serve as a model |100101### Step 5: Execute the Exercise102103#### Facilitation Guide104105| Phase | Facilitator Actions |106|-------|-------------------|107| **Pre-brief** (15 min) | Welcome; state objectives; explain rules (safe space, no blame); distribute scenario setup |108| **Phase 1: Setup** (20 min) | Read scenario trigger; ask "What do you do first?"; let team self-organize |109| **Phase 2: Escalation** (30 min) | Introduce injects at planned intervals; increase pressure; observe decision-making |110| **Phase 3: Peak** (30 min) | Multiple simultaneous injects; conflicting information; ask for prioritization decisions |111| **Phase 4: Resolution** (20 min) | Signal situation stabilizing; ask for recovery transition plan; final communications |112| **Hot debrief** (30 min) | What went well? What surprised you? What would you do differently? |113114#### Ground Rules115116- This is a learning exercise, not a test — no blame for mistakes117- Stay in role — respond as you would in a real crisis118- Phones on silent (unless part of the exercise)119- All decisions and communications are "simulated" — nothing goes external120- If you do not know the answer, that is a finding — say so121- Evaluators observe silently during the exercise; feedback comes in the debrief122123### Step 6: Capture Lessons Learned124125## Output Format126127```markdown128## Crisis Simulation Report: [Scenario Name] — [Date]129130### Exercise Overview131- **Scenario**: [Brief description]132- **Type**: [Tabletop / Functional / Full simulation]133- **Duration**: [Actual duration]134- **Participants**: [N] ([List of roles])135- **Facilitator**: [Name]136- **Evaluator**: [Name]137138### Scenario Summary139[Description of scenario as it unfolded, including all injects and timing]140141### Timeline of Decisions142| Time | Inject / Event | Decision Made | By Whom | Assessment |143|------|---------------|--------------|---------|-----------|144145### Evaluation Scorecard146| Competency | Score (1-5) | Strengths | Gaps |147|------------|:-----------:|-----------|------|148149### Key Findings150#### What Worked Well1511. [Finding with specific evidence]1522. [Finding with specific evidence]153154#### Areas for Improvement1551. [Finding with specific evidence and recommendation]1562. [Finding with specific evidence and recommendation]157158### Action Items159| # | Action | Finding | Owner | Priority | Deadline |160|---|--------|---------|-------|----------|----------|161162### Plan Updates Required163| Plan | Section | Update Needed | Owner |164|------|---------|--------------|-------|165166### Participant Feedback167[Summary of participant self-assessment and suggestions]168169### Next Exercise170- **Recommended scenario**: [Based on gaps found]171- **Recommended timing**: [Date]172- **Focus area**: [Specific competency to improve]173```174175## Quality Checklist176177- [ ] Scenario is realistic and relevant to the organization's actual risk profile178- [ ] Exercise has clear, measurable objectives — not just "practice crisis response"179- [ ] Scenario escalates in complexity and requires real decisions, not just information-sharing180- [ ] Evaluation criteria are defined before the exercise, not invented afterward181- [ ] All key crisis roles are represented as participants182- [ ] Lessons learned are translated into specific action items with owners and deadlines183- [ ] Action items are tracked to completion — not forgotten after the exercise ends184185## Edge Cases186187- **Participants who have never been in a real crisis**: Provide more coaching and pre-reading; pair with experienced members; keep the first exercise simple188- **Senior executives who resist participation**: Frame it as strategic decision practice, not compliance; keep their time commitment short (2 hours max); make it relevant to their decisions189- **Exercise reveals a critical gap**: If the gap is severe (e.g., no backup for a critical system), escalate immediately rather than waiting for the post-exercise report190- **Participants break character or treat it as a joke**: Facilitator resets expectations; emphasize real-world consequences; use actual past incidents as context191- **Remote or hybrid exercise**: Use video conferencing with dedicated channels for injects; simulate communication challenges by introducing "connectivity issues" for realism192- **Regulatory-mandated exercises**: Ensure documentation meets regulatory requirements; involve compliance in exercise design and review