An incident response workshop for the people who decide and the people who act.

It helps, in a practical way: you rehearse incident handling, crisis management and the NIS2 reporting deadlines on your own plans. It is not an audit, and we issue no compliance statement. What the law asks of executive board members is explained on the Board & Executive Workshop page.

We open with the threat landscape, then work through nine modules: how an attack unfolds; one real incident, hour by hour; the dos and don'ts of the first hours; initial triage; evidence gathering; investigation and communication, including the NIS2 reporting deadlines; decision-making under pressure; case closure; and building your own crisis plan from the open NCSC, CISA and BSI frameworks. The day closes with a live four-round tabletop exercise.

A tabletop exercise, also called a cyber crisis exercise, is a rehearsal of a cyber incident, talked through around a table. In this workshop one fictional incident unfolds over four rounds, built on a real ransomware case: a quiet alert, a warning from outside, the attack itself, then the public pressure. The information arrives the way it does in a real breach, in pieces and rarely when you want it. Each round you make the calls for your own organisation, using your own plans. If the debrief shows gaps that call for structural work, Capability Building picks them up.