Description

This curriculum spans the full lifecycle of crisis management in security operations, comparable in scope to an organization’s end-to-end incident readiness program, integrating risk assessment, command structure, legal compliance, third-party coordination, and continuous simulation-driven improvement.

Module 1: Crisis Preparedness and Risk Assessment

Conducting threat modeling exercises to prioritize risks based on likelihood, impact, and organizational exposure across physical and digital assets.
Establishing cross-functional crisis planning teams with defined roles, escalation paths, and decision-making authorities during high-pressure scenarios.
Integrating business impact analysis (BIA) results into crisis plans to align recovery objectives with operational criticality.
Deciding which assets and systems require redundancy or failover based on recovery time objectives (RTO) and recovery point objectives (RPO).
Validating the comprehensiveness of threat inventories by incorporating intelligence from law enforcement, industry ISACs, and internal incident logs.
Documenting assumptions and limitations in risk assessments to ensure stakeholders understand the boundaries of preparedness plans.

Module 2: Crisis Communication Strategy and Stakeholder Management

Designing communication protocols that specify message ownership, approval workflows, and distribution channels for internal and external audiences.
Pre-drafting crisis message templates for various scenarios while maintaining flexibility to adapt to evolving facts.
Establishing criteria for when and how to notify regulators, law enforcement, customers, and the media during an active incident.
Coordinating with legal and PR teams to balance transparency with liability exposure in public statements.
Implementing secure, resilient communication channels (e.g., satellite phones, encrypted messaging) that remain operational during infrastructure outages.
Assigning spokespersons with media training and subject matter expertise to maintain consistent messaging during prolonged crises.

Module 3: Incident Command and Decision Governance

Activating an incident command structure with clear roles (e.g., incident commander, operations lead, logistics coordinator) during crisis onset.
Implementing decision logs to record critical choices, rationale, and participants for post-crisis review and regulatory compliance.
Establishing thresholds for escalating decisions to executive leadership or board-level oversight based on financial, reputational, or legal impact.
Managing conflicting priorities between operational continuity, forensic preservation, and legal holds during incident response.
Rotating command staff during extended crises to prevent fatigue-related decision errors and maintain situational awareness.
Conducting real-time triage of incoming intelligence to distinguish signal from noise under time pressure.

Module 4: Technical Response and Containment Operations

Executing network segmentation or isolation procedures to contain threat propagation while minimizing business disruption.
Deciding whether to disconnect compromised systems based on the risk of evidence loss versus ongoing damage.
Deploying forensic imaging tools in live environments without altering system states or violating chain-of-custody requirements.
Coordinating with IT operations to apply emergency patches or configuration changes under change advisory board (CAB) exemptions.
Preserving logs and artifacts in a forensically sound manner for potential legal proceedings or regulatory audits.
Integrating threat intelligence feeds into SIEM platforms during active incidents to identify lateral movement or command-and-control activity.

Module 5: Legal, Regulatory, and Compliance Considerations

Initiating breach notification procedures within mandated timeframes under GDPR, HIPAA, or sector-specific regulations.
Engaging legal counsel early to manage privilege boundaries between internal investigations and regulatory cooperation.
Documenting response actions to demonstrate compliance with due care and due diligence standards during audits or litigation.
Handling cross-border data transfers during investigations in compliance with local data sovereignty laws.
Managing interactions with regulators by defining who can speak, what information can be shared, and under what conditions.
Retaining incident-related records according to organizational records management policies and legal hold requirements.

Module 6: Third-Party and Supply Chain Crisis Coordination

Activating contractual incident notification clauses with vendors and managed service providers during supply chain compromises.
Assessing the security posture of critical suppliers during a crisis to determine potential cascading impacts.
Coordinating forensic access to third-party systems while respecting contractual and operational boundaries.
Managing joint communication strategies with partners to avoid contradictory public statements or customer confusion.
Enforcing incident response SLAs defined in service agreements and documenting non-compliance for contractual review.
Conducting post-incident reviews with vendors to update risk profiles and contractual obligations.

Module 7: Post-Crisis Recovery and Organizational Learning

Validating system integrity and functionality before returning services to normal operations after containment.
Executing phased reintegration of isolated networks or systems to prevent re-introduction of threats.
Conducting structured incident debriefs with participants to capture lessons learned, decision challenges, and process gaps.
Updating crisis plans and playbooks based on findings from post-mortem analyses and tabletop exercise outcomes.
Measuring recovery performance against predefined KPIs such as mean time to detect (MTTD) and mean time to respond (MTTR).
Implementing technical and procedural controls to address root causes and reduce likelihood of recurrence.

Module 8: Crisis Simulation and Continuous Readiness Testing

Designing scenario-based tabletop exercises that reflect realistic threat actors, attack vectors, and operational constraints.
Introducing injects during simulations to test decision-making under uncertainty and time pressure.
Measuring participant performance against predefined success criteria for communication, coordination, and execution.
Rotating participants across roles in simulations to build organizational depth and reduce single points of failure.
Integrating red team findings into crisis training to reflect current adversary tactics and techniques.
Scheduling recurring simulations at least biannually and after significant infrastructure or personnel changes.