I would rather discover missing shutdown authority in a meeting than while a compromised service keeps accepting transactions. A cyber crisis rehearsal should expose whether people, information and authority connect under pressure. I want participants to choose between imperfect options and explain what happens when a request goes unanswered.
Start with a business promise
I would choose the promise under strain before writing the scenario: reliable deliveries, accurate balances or restricted information. Then I would define observable decisions, including who can suspend service and approve temporary operation. Saying “we would escalate” is incomplete unless someone identifies the recipient, the request and the fallback if nobody answers.
Imagine a distributor finding suspicious privileged activity in its warehouse systems. Some shipments continue, but nobody knows whether instructions were altered. Security wants to isolate shared access; operations wants unaffected warehouses to stay open. No symptoms does not mean a warehouse is safe.
Make the choice explicit
I would record six things for each consequential decision: the choice, its owner, the latest responsible decision point, evidence and its limits, available options, and the condition for review. Further investigation is an option with costs, rather than an escape from choosing.
Full isolation may interrupt legitimate deliveries; selective isolation may leave exposure. Continuing with independent checks depends on whether those checks are workable. I would demand stronger support for consequences that are difficult to reverse, remembering that delay can also cause irreversible harm. Each team should explain what would change its view.
Challenge recovery and authority
I would introduce a recovery surprise: the recent backup depends on an access service still under investigation. An older independent copy omits later orders. Waiting preserves possible transaction history but extends uncertainty; restoring the older copy creates reconciliation work. I would ask whether the source is trustworthy, the service can run and missing transactions can be reconciled.
Then I would make the expected executive unavailable. A substitute needs approved limits for spending, service suspension and factual customer updates. Technical redundancy cannot compensate for authority that disappears with one person.
Follow the request into action
I would ask the sender to state the action, the receiver to explain its operational meaning and both to agree on the next report. A message sent is no proof that work changed. Unanswered requests need owners and fallbacks.
A discussion can rehearse a decision without demonstrating a restoration. I would keep asserted capabilities separate from tested ones, assign each gap an owner and completion evidence, then repeat the failed decision or handoff. The value is a repair the business can verify and a promise it can defend.