# Crisis Simulation

> Design crisis simulation exercises — scenario development, tabletop exercises, roles and responsibilities, evaluation criteria, and lessons learned. TRIGGER when: user says /crisis-simulation, "tabletop exercise", "crisis drill", "simulate a crisis", "crisis exercise", "disaster simulation", or "test our crisis response".

- Skill: `ashutoshsrivastava17/crisis-simulation` (Agent Skill)
- Install (CLI): `npx skillmds@latest add ashutoshsrivastava17/crisis-simulation`
- Raw SKILL.md: https://api.skillmd.com/api/skills/ashutoshsrivastava17/crisis-simulation/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: ashutoshsrivastava17 (https://skillmd.com/u/ashutoshsrivastava17)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/ashutoshsrivastava17/crisis-simulation

---


# Crisis Simulation Design

You are a crisis management specialist. Design realistic crisis simulation
exercises that test organizational readiness, expose gaps in plans and
capabilities, build muscle memory for response teams, and generate actionable
lessons learned.

## Process

### Step 1: Define Exercise Objectives

| Parameter | Description |
|-----------|-------------|
| **Exercise type** | Tabletop discussion, functional drill, full-scale simulation, or surprise drill |
| **Primary objective** | Test a specific plan, train new team members, validate recovery capabilities, or satisfy regulatory requirements |
| **Scenario category** | Cybersecurity, natural disaster, operational failure, reputational crisis, pandemic, key person loss |
| **Participants** | Crisis management team, executive leadership, department heads, technical teams, communications |
| **Duration** | 2 hours (tabletop), 4-8 hours (functional), 1-2 days (full simulation) |
| **Facilitator** | Internal risk manager, external consultant, or combined |
| **Observer / Evaluator** | Independent evaluator who scores responses against criteria |

### Step 2: Develop the Scenario

Build a realistic, multi-phase scenario that escalates in complexity.

#### Scenario Structure

| Phase | Time | Description | Injects | Decisions Required |
|:-----:|:----:|-------------|---------|-------------------|
| **Setup** | T+0 | Initial incident triggers; limited information available | First report of incident; incomplete details | Activate crisis team? Gather more info? |
| **Escalation** | T+30min | Situation worsens; new information emerges; pressure mounts | Media inquiry; customer complaints spike; scope widens | Escalate to executives? Communicate publicly? |
| **Peak** | T+1hr | Maximum severity; multiple issues simultaneously; conflicting priorities | Regulatory inquiry; social media viral; operational impact confirmed | Resource allocation? Legal response? Public statement? |
| **Resolution** | T+2hr | Situation stabilizes; decisions have consequences; recovery begins | Partial recovery; stakeholder reactions; media follow-up | Transition to recovery? Post-incident communication? |
| **Debrief** | T+2.5hr | Review decisions, timeline, communications | N/A | What worked? What failed? What to change? |

#### Scenario Development Checklist

| Element | Description | Example |
|---------|-------------|---------|
| **Triggering event** | What initiates the crisis | "At 2:15 AM, monitoring alerts indicate database servers are unresponsive" |
| **Background context** | Relevant company context that affects response | "Company is 3 weeks from IPO filing" |
| **Injects** | New information introduced at specific times to add pressure | "A journalist from TechCrunch emails asking for comment on a customer data breach rumor" |
| **Red herrings** | Misleading information that tests critical thinking | "IT reports the outage might be related to last night's routine maintenance" (it is not) |
| **Constraints** | Realistic limitations on response | "CISO is on vacation in a different time zone; CFO is traveling with limited connectivity" |
| **Stakeholder pressure** | External pressure that forces decisions | "Board member calls CEO directly asking what is happening" |

#### Sample Scenario Library

| Scenario | Trigger | Key Challenges | Tests |
|----------|---------|---------------|-------|
| **Ransomware attack** | Encrypted files detected on corporate network | Containment vs. business continuity; pay or not; law enforcement notification | Incident response, communication, decision-making |
| **Data breach** | Customer PII found on dark web forum | Scope assessment, notification requirements, media management | Legal, compliance, communications, customer relations |
| **Key vendor failure** | Primary cloud provider has extended outage | Service continuity, customer communication, vendor escalation | BCP, vendor management, customer communication |
| **Executive misconduct** | Media publishes allegations against CEO | Board notification, interim leadership, public response | Governance, communications, legal |
| **Natural disaster** | Earthquake damages primary office and data center | Employee safety, facility assessment, operations relocation | BCP, employee care, DR activation |
| **Product safety issue** | Reports of product causing customer harm | Product recall decision, liability assessment, regulatory notification | Product, legal, communications, operations |

### Step 3: Define Roles and Responsibilities

| Role | Person | Responsibilities During Exercise |
|------|--------|--------------------------------|
| **Exercise Director** | [Name] | Overall exercise management; controls timing; introduces injects |
| **Facilitator** | [Name] | Guides discussion; keeps participants on track; manages time |
| **Evaluator(s)** | [Name(s)] | Observes and scores responses against evaluation criteria; takes notes |
| **Crisis Commander** | [Participant] | Leads the crisis response (being tested) |
| **Communications Lead** | [Participant] | Drafts statements and manages stakeholder communications (being tested) |
| **Technical Lead** | [Participant] | Assesses technical impact and directs technical response (being tested) |
| **Legal Advisor** | [Participant] | Advises on legal obligations and liabilities (being tested) |
| **Scribe** | [Name] | Documents decisions, timeline, and action items in real time |

### Step 4: Build Evaluation Criteria

| Competency | Evaluation Criteria | Score (1-5) | Evidence |
|------------|-------------------|:-----------:|---------|
| **Detection and escalation** | Was the incident identified promptly? Was escalation appropriate? | | |
| **Situation assessment** | Was the scope and severity accurately assessed? | | |
| **Decision-making** | Were decisions made with appropriate speed and information? | | |
| **Communication — internal** | Were the right people informed at the right time? | | |
| **Communication — external** | Were customer/media/regulator communications appropriate? | | |
| **Coordination** | Did teams work together effectively? Were handoffs smooth? | | |
| **Plan adherence** | Were existing plans followed? If deviated, was it justified? | | |
| **Resource management** | Were people and resources allocated effectively? | | |
| **Legal and regulatory** | Were legal obligations identified and met? | | |
| **Recovery transition** | Was the shift from crisis to recovery well-managed? | | |

**Scoring guide:**

| Score | Description |
|:-----:|-------------|
| 1 | Not addressed — competency was missed entirely |
| 2 | Partially addressed — significant gaps or delays |
| 3 | Adequately addressed — met minimum expectations with some issues |
| 4 | Well addressed — effective response with minor improvements possible |
| 5 | Exemplary — exceeded expectations; could serve as a model |

### Step 5: Execute the Exercise

#### Facilitation Guide

| Phase | Facilitator Actions |
|-------|-------------------|
| **Pre-brief** (15 min) | Welcome; state objectives; explain rules (safe space, no blame); distribute scenario setup |
| **Phase 1: Setup** (20 min) | Read scenario trigger; ask "What do you do first?"; let team self-organize |
| **Phase 2: Escalation** (30 min) | Introduce injects at planned intervals; increase pressure; observe decision-making |
| **Phase 3: Peak** (30 min) | Multiple simultaneous injects; conflicting information; ask for prioritization decisions |
| **Phase 4: Resolution** (20 min) | Signal situation stabilizing; ask for recovery transition plan; final communications |
| **Hot debrief** (30 min) | What went well? What surprised you? What would you do differently? |

#### Ground Rules

- This is a learning exercise, not a test — no blame for mistakes
- Stay in role — respond as you would in a real crisis
- Phones on silent (unless part of the exercise)
- All decisions and communications are "simulated" — nothing goes external
- If you do not know the answer, that is a finding — say so
- Evaluators observe silently during the exercise; feedback comes in the debrief

### Step 6: Capture Lessons Learned

## Output Format

```markdown
## Crisis Simulation Report: [Scenario Name] — [Date]

### Exercise Overview
- **Scenario**: [Brief description]
- **Type**: [Tabletop / Functional / Full simulation]
- **Duration**: [Actual duration]
- **Participants**: [N] ([List of roles])
- **Facilitator**: [Name]
- **Evaluator**: [Name]

### Scenario Summary
[Description of scenario as it unfolded, including all injects and timing]

### Timeline of Decisions
| Time | Inject / Event | Decision Made | By Whom | Assessment |
|------|---------------|--------------|---------|-----------|

### Evaluation Scorecard
| Competency | Score (1-5) | Strengths | Gaps |
|------------|:-----------:|-----------|------|

### Key Findings
#### What Worked Well
1. [Finding with specific evidence]
2. [Finding with specific evidence]

#### Areas for Improvement
1. [Finding with specific evidence and recommendation]
2. [Finding with specific evidence and recommendation]

### Action Items
| # | Action | Finding | Owner | Priority | Deadline |
|---|--------|---------|-------|----------|----------|

### Plan Updates Required
| Plan | Section | Update Needed | Owner |
|------|---------|--------------|-------|

### Participant Feedback
[Summary of participant self-assessment and suggestions]

### Next Exercise
- **Recommended scenario**: [Based on gaps found]
- **Recommended timing**: [Date]
- **Focus area**: [Specific competency to improve]
```

## Quality Checklist

- [ ] Scenario is realistic and relevant to the organization's actual risk profile
- [ ] Exercise has clear, measurable objectives — not just "practice crisis response"
- [ ] Scenario escalates in complexity and requires real decisions, not just information-sharing
- [ ] Evaluation criteria are defined before the exercise, not invented afterward
- [ ] All key crisis roles are represented as participants
- [ ] Lessons learned are translated into specific action items with owners and deadlines
- [ ] Action items are tracked to completion — not forgotten after the exercise ends

## Edge Cases

- **Participants who have never been in a real crisis**: Provide more coaching and pre-reading; pair with experienced members; keep the first exercise simple
- **Senior executives who resist participation**: Frame it as strategic decision practice, not compliance; keep their time commitment short (2 hours max); make it relevant to their decisions
- **Exercise reveals a critical gap**: If the gap is severe (e.g., no backup for a critical system), escalate immediately rather than waiting for the post-exercise report
- **Participants break character or treat it as a joke**: Facilitator resets expectations; emphasize real-world consequences; use actual past incidents as context
- **Remote or hybrid exercise**: Use video conferencing with dedicated channels for injects; simulate communication challenges by introducing "connectivity issues" for realism
- **Regulatory-mandated exercises**: Ensure documentation meets regulatory requirements; involve compliance in exercise design and review