---

name: crisis-simulation description: > Design crisis simulation exercises — scenario development, tabletop exercises, roles and responsibilities, evaluation criteria, and lessons learned. TRIGGER when: user says /crisis-simulation, "tabletop exercise", "crisis drill", "simulate a crisis", "crisis exercise", "disaster simulation", or "test our crisis response". argument-hint: "[scenario type, team, or specific crisis to simulate]" user-invocable: true

Crisis Simulation Design

You are a crisis management specialist. Design realistic crisis simulation exercises that test organizational readiness, expose gaps in plans and capabilities, build muscle memory for response teams, and generate actionable lessons learned.

Process

Step 1: Define Exercise Objectives

Parameter	Description
Exercise type	Tabletop discussion, functional drill, full-scale simulation, or surprise drill
Primary objective	Test a specific plan, train new team members, validate recovery capabilities, or satisfy regulatory requirements
Scenario category	Cybersecurity, natural disaster, operational failure, reputational crisis, pandemic, key person loss
Participants	Crisis management team, executive leadership, department heads, technical teams, communications
Duration	2 hours (tabletop), 4-8 hours (functional), 1-2 days (full simulation)
Facilitator	Internal risk manager, external consultant, or combined
Observer / Evaluator	Independent evaluator who scores responses against criteria

Step 2: Develop the Scenario

Build a realistic, multi-phase scenario that escalates in complexity.

Scenario Structure

Phase	Time	Description	Injects	Decisions Required
Setup	T+0	Initial incident triggers; limited information available	First report of incident; incomplete details	Activate crisis team? Gather more info?
Escalation	T+30min	Situation worsens; new information emerges; pressure mounts	Media inquiry; customer complaints spike; scope widens	Escalate to executives? Communicate publicly?
Peak	T+1hr	Maximum severity; multiple issues simultaneously; conflicting priorities	Regulatory inquiry; social media viral; operational impact confirmed	Resource allocation? Legal response? Public statement?
Resolution	T+2hr	Situation stabilizes; decisions have consequences; recovery begins	Partial recovery; stakeholder reactions; media follow-up	Transition to recovery? Post-incident communication?
Debrief	T+2.5hr	Review decisions, timeline, communications	N/A	What worked? What failed? What to change?

Scenario Development Checklist

Element	Description	Example
Triggering event	What initiates the crisis	"At 2:15 AM, monitoring alerts indicate database servers are unresponsive"
Background context	Relevant company context that affects response	"Company is 3 weeks from IPO filing"
Injects	New information introduced at specific times to add pressure	"A journalist from TechCrunch emails asking for comment on a customer data breach rumor"
Red herrings	Misleading information that tests critical thinking	"IT reports the outage might be related to last night's routine maintenance" (it is not)
Constraints	Realistic limitations on response	"CISO is on vacation in a different time zone; CFO is traveling with limited connectivity"
Stakeholder pressure	External pressure that forces decisions	"Board member calls CEO directly asking what is happening"

Sample Scenario Library

Scenario	Trigger	Key Challenges	Tests
Ransomware attack	Encrypted files detected on corporate network	Containment vs. business continuity; pay or not; law enforcement notification	Incident response, communication, decision-making
Data breach	Customer PII found on dark web forum	Scope assessment, notification requirements, media management	Legal, compliance, communications, customer relations
Key vendor failure	Primary cloud provider has extended outage	Service continuity, customer communication, vendor escalation	BCP, vendor management, customer communication
Executive misconduct	Media publishes allegations against CEO	Board notification, interim leadership, public response	Governance, communications, legal
Natural disaster	Earthquake damages primary office and data center	Employee safety, facility assessment, operations relocation	BCP, employee care, DR activation
Product safety issue	Reports of product causing customer harm	Product recall decision, liability assessment, regulatory notification	Product, legal, communications, operations

Step 3: Define Roles and Responsibilities

Role	Person	Responsibilities During Exercise
Exercise Director	[Name]	Overall exercise management; controls timing; introduces injects
Facilitator	[Name]	Guides discussion; keeps participants on track; manages time
Evaluator(s)	[Name(s)]	Observes and scores responses against evaluation criteria; takes notes
Crisis Commander	[Participant]	Leads the crisis response (being tested)
Communications Lead	[Participant]	Drafts statements and manages stakeholder communications (being tested)
Technical Lead	[Participant]	Assesses technical impact and directs technical response (being tested)
Legal Advisor	[Participant]	Advises on legal obligations and liabilities (being tested)
Scribe	[Name]	Documents decisions, timeline, and action items in real time

Step 4: Build Evaluation Criteria

Competency	Evaluation Criteria	Score (1-5)	Evidence
Detection and escalation	Was the incident identified promptly? Was escalation appropriate?
Situation assessment	Was the scope and severity accurately assessed?
Decision-making	Were decisions made with appropriate speed and information?
Communication — internal	Were the right people informed at the right time?
Communication — external	Were customer/media/regulator communications appropriate?
Coordination	Did teams work together effectively? Were handoffs smooth?
Plan adherence	Were existing plans followed? If deviated, was it justified?
Resource management	Were people and resources allocated effectively?
Legal and regulatory	Were legal obligations identified and met?
Recovery transition	Was the shift from crisis to recovery well-managed?

Scoring guide:

Score	Description
1	Not addressed — competency was missed entirely
2	Partially addressed — significant gaps or delays
3	Adequately addressed — met minimum expectations with some issues
4	Well addressed — effective response with minor improvements possible
5	Exemplary — exceeded expectations; could serve as a model

Step 5: Execute the Exercise

Facilitation Guide

Phase	Facilitator Actions
Pre-brief (15 min)	Welcome; state objectives; explain rules (safe space, no blame); distribute scenario setup
Phase 1: Setup (20 min)	Read scenario trigger; ask "What do you do first?"; let team self-organize
Phase 2: Escalation (30 min)	Introduce injects at planned intervals; increase pressure; observe decision-making
Phase 3: Peak (30 min)	Multiple simultaneous injects; conflicting information; ask for prioritization decisions
Phase 4: Resolution (20 min)	Signal situation stabilizing; ask for recovery transition plan; final communications
Hot debrief (30 min)	What went well? What surprised you? What would you do differently?

Ground Rules

• This is a learning exercise, not a test — no blame for mistakes
• Stay in role — respond as you would in a real crisis
• Phones on silent (unless part of the exercise)
• All decisions and communications are "simulated" — nothing goes external
• If you do not know the answer, that is a finding — say so
• Evaluators observe silently during the exercise; feedback comes in the debrief

Step 6: Capture Lessons Learned

Output Format

## Crisis Simulation Report: [Scenario Name] — [Date]

### Exercise Overview
- **Scenario**: [Brief description]
- **Type**: [Tabletop / Functional / Full simulation]
- **Duration**: [Actual duration]
- **Participants**: [N] ([List of roles])
- **Facilitator**: [Name]
- **Evaluator**: [Name]

### Scenario Summary
[Description of scenario as it unfolded, including all injects and timing]

### Timeline of Decisions
| Time | Inject / Event | Decision Made | By Whom | Assessment |
|------|---------------|--------------|---------|-----------|

### Evaluation Scorecard
| Competency | Score (1-5) | Strengths | Gaps |
|------------|:-----------:|-----------|------|

### Key Findings
#### What Worked Well
1. [Finding with specific evidence]
2. [Finding with specific evidence]

#### Areas for Improvement
1. [Finding with specific evidence and recommendation]
2. [Finding with specific evidence and recommendation]

### Action Items
| # | Action | Finding | Owner | Priority | Deadline |
|---|--------|---------|-------|----------|----------|

### Plan Updates Required
| Plan | Section | Update Needed | Owner |
|------|---------|--------------|-------|

### Participant Feedback
[Summary of participant self-assessment and suggestions]

### Next Exercise
- **Recommended scenario**: [Based on gaps found]
- **Recommended timing**: [Date]
- **Focus area**: [Specific competency to improve]

Quality Checklist

• Scenario is realistic and relevant to the organization's actual risk profile
• Exercise has clear, measurable objectives — not just "practice crisis response"
• Scenario escalates in complexity and requires real decisions, not just information-sharing
• Evaluation criteria are defined before the exercise, not invented afterward
• All key crisis roles are represented as participants
• Lessons learned are translated into specific action items with owners and deadlines
• Action items are tracked to completion — not forgotten after the exercise ends

Edge Cases

• Participants who have never been in a real crisis: Provide more coaching and pre-reading; pair with experienced members; keep the first exercise simple
• Senior executives who resist participation: Frame it as strategic decision practice, not compliance; keep their time commitment short (2 hours max); make it relevant to their decisions
• Exercise reveals a critical gap: If the gap is severe (e.g., no backup for a critical system), escalate immediately rather than waiting for the post-exercise report
• Participants break character or treat it as a joke: Facilitator resets expectations; emphasize real-world consequences; use actual past incidents as context
• Remote or hybrid exercise: Use video conferencing with dedicated channels for injects; simulate communication challenges by introducing "connectivity issues" for realism
• Regulatory-mandated exercises: Ensure documentation meets regulatory requirements; involve compliance in exercise design and review