Practising the Judgement Call: Board Cyber Exercises That Change What Happens Next

There is a familiar pattern to the board cyber exercise. A facilitator arrives with a scenario, a slide deck and a countdown clock. Directors are told that a ransomware crew has encrypted the order book and that the press has started calling. Forty minutes of sensible conversation follows, in which everyone behaves reasonably, nobody is wrong, and the session closes with a general view that the organisation would manage. Tea is served. Nothing is subsequently amended.

That is not a test. It is a formality with a plot. The distinction matters because the exercise is one of the few occasions on which a board can observe its own decision-making under pressure without the cost of a real incident — and most boards spend that opportunity confirming what they already believe.

Begin with the decision, not the narrative

Scenario design usually starts with the threat: a particular strain of malware, a particular supplier, a particular regulatory deadline. It should start with the decision the board is likely to get wrong.

Before the facilitator writes a single paragraph of storyline, the board should be able to name three or four judgements it genuinely does not know how it would reach. Does authority to shut down a customer-facing service sit with the chief executive, the chief operating officer or the incident lead? At what point does the board itself convene, and who decides? If a ransom demand arrives on a Friday evening, who may engage a negotiator, and against what delegated limit? If the insurer's approved responder and the company's retained adviser give conflicting advice, whose view prevails?

These are not security questions. They are questions of authority, appetite and delegation, and they belong in the exercise precisely because a real incident will not wait for them to be settled. A scenario that does not reach them has failed as a design.

Choose the room deliberately

The composition of the exercise is itself a governance choice. Attendance by the full board, the executive team and the company secretary is the minimum. Consideration should be given to whether the general counsel, the head of communications and the relevant business unit lead are present — not as observers, but as participants who will be required to make commitments.

Equally important is who is deliberately excluded. A common weakness is the exercise that includes the chief information security officer throughout, allowing the board to defer to technical judgement whenever the conversation becomes uncomfortable. For at least part of the session, directors should sit with the problem alone, as they would in the first hour of a genuine crisis, with technical support available on request rather than by default.

Where the organisation operates under the senior managers and certification regime, or has published impact tolerances under the operational resilience rules, those constructs should be visible in the room. An exercise that ignores the documented tolerances the firm has already committed to is an exercise that will not change anything.

Brief the observer properly

Most exercises have no independent scrutiny at all. The facilitator runs the session and the chair pronounces it useful. A better model gives a named observer — often an internal auditor, a non-executive director from another organisation, or an external adviser — a specific and narrow mandate: to record not what was decided, but how.

What information did directors ask for that did not exist? How long did it take the group to establish who was in charge? When the conversation turned to notification, did anyone reach for the actual regulatory timetable, or did they rely on recollection? Did the discussion of insurance begin with coverage or with the notification conditions in the policy? Did anyone ask whether the supplier in the scenario had been contractually obliged to tell the company anything at all?

The observer's notes are the real product of the morning. A verdict of "constructive" is worth nothing. A list of eleven questions the board could not answer is worth a great deal.

Treat assumptions as the deliverable

Every exercise generates a set of working assumptions: that the insurer will appoint a forensics firm within four hours, that the payroll provider holds offline backups, that the regulator will accept a preliminary notification and follow up in writing, that the communications team can reach the chief executive out of hours.

These should be written down, attributed and dated. Each should then be tested, either by the second line or by the relevant function, and returned to the board with a status: validated, unvalidated, or disproved. An exercise that produces a register of twelve assumptions, of which three turn out to be false, has done more for the organisation's resilience than any number of maturity assessments.

Close the loop into documents, not memories

The most common failure occurs after the room empties. Actions are noted, ownership is nominal, and the next quarter's board pack makes no reference to any of it. To avoid this, the exercise should be tied to specific artefacts that must change as a result.

These typically include the incident response plan's escalation triggers and contact hierarchy; the delegated authority matrix for spend, communications and third-party engagement; the supplier register, where exercise findings frequently reveal that critical providers have no notification obligation; and the cyber insurance file, where the policy's cooperation and notification conditions should be checked against the timeline the board has just rehearsed. A short covering paper to the next audit or risk committee, setting out which documents were amended and which assumptions remain open, converts a training event into governance evidence.

Reading the exercise as assurance

For directors, the test of a well-run exercise is simple. Did it change anything that will be relied upon in a real incident? If the answer is yes, the board has genuine evidence of preparedness — the kind that stands up in a sale process, a regulatory conversation or an insurance renewal. If the answer is no, the organisation has rehearsed its own confidence, and learned nothing that a bad Tuesday morning will not teach it more expensively.

The exercise is not the test of the board's cyber capability. It is the test of whether the board is willing to be tested. The scenario is merely the instrument; the judgement is the point.