Readiness is a habit, not a project

Why a plan ages

None of the above is the fault of the plan’s authors. An organization lives, and each of its changes, ordinary in itself, quietly invalidates a line of the text: an employee changes role, a system migrates to the cloud, a supplier is replaced, a site opens or closes. None of these decisions is made with the crisis plan in mind, and that is normal, because they answer other needs. But the cumulative effect is real. After a year, the contact list and the map of dependencies no longer describe the organization, and nobody knows it until they need them.

That is why a dated plan proves nothing, however carefully it was written. Its date says when it was accurate, not whether it still is. Only a recent test says whether the organization described is still the one that exists.

Once a year is not enough

A yearly exercise, in reality, tests the organization of a year ago. Between two exercises, participants forget part of what they learned, and newcomers have never played. It is better to run shorter, more frequent and more varied exercises: ransomware, a data leak, an incident at a supplier, the loss of a site, with different roles each time and management around the table.

A realistic rhythm for a year could look like this: a tabletop exercise with management in the first quarter, a simulation with the IT teams in the second, a scenario built around a supplier in the third, an exercise on communication and the authorities in the fourth. Each lasts less than half a day, and the report of one feeds the preparation of the next. In our fictional company, this cadence would have brought out the security manager’s departure in the second quarter, because the simulation would have stumbled on a role with no one in it, and the warehouse opening in the third, because a scenario about losing a site would not have found it on the list.

What makes repetition possible: cost

The main obstacle to this cadence is cost. An exercise run by a provider needs several days of preparation and a budget for each session, so it is done once and that is where it stops. If preparing an exercise takes a few minutes instead of several days, repeating becomes realistic. That is UnderCrisis’s bet: generate the exercise from your context, on a low budget, so that it can be replayed. This does not remove the essential, which remains human: that the right people are in the room, and that the gaps found are fixed.

Measure progress, and the compliance that follows

Repeating makes sense only if you can see what improves. A few indicators are enough, tracked from one exercise to the next: the time before the first decision, the time before notification, the share of the last exercise’s actions really closed, the number of roles that held their place. You close the previous exercise’s actions before launching a new one, and sometimes replay the same scenario to see what has changed.

Compliance follows from this discipline more than it dictates it. The NIS2 directive requires measures for incident handling, business continuity and crisis management. The DORA regulation requires financial entities to have a digital operational resilience testing program, which includes scenario-based tests. The GDPR’s 72-hour deadline is only met if someone knows that notification is theirs. The authorities ask for evidence, and the report of an exercise, with its traces, is one. Compliance is the consequence of a prepared organization, not its goal, and the fictional March company would have understood this in October: preparation does not end with the project, it begins there.