Exercise Builder

null

[{"category": "Cyber", "context": "At 07:45 on a Monday morning the IT helpdesk begins receiving reports of encrypted files and ransom notes appearing on workstations across two sites. Core business applications are unavailable. The attacker demands payment within 72 hours or threatens to publish exfiltrated data.", "default_objectives": ["Activate and test the Cyber Incident Response Plan", "Assess communication and escalation protocols", "Evaluate decision-making under time pressure", "Test data recovery and system restoration procedures", "Assess third-party and regulatory notification processes"], "description": "Critical systems are encrypted by ransomware, threatening operational continuity and data integrity.", "id": 1, "is_builtin": true, "name": "Ransomware Attack", "sample_injects": ["IT team confirms 60% of servers are encrypted", "Ransom demand of $2M received via email", "Media outlet contacts PR team for comment", "Regulator requests a status update within 4 hours", "Backup systems found to also be compromised", "Key supplier reports they cannot receive orders"]}, {"category": "Health \u0026 Safety", "context": "A respiratory illness has spread rapidly within the workforce. Within 72 hours, 40% of staff across all departments are absent. Public health guidance recommends isolation for close contacts. No immediate end to the outbreak is in sight.", "default_objectives": ["Test people resilience and cross-training coverage", "Assess remote-working and reduced-capacity operating procedures", "Evaluate staff welfare and communication channels", "Test prioritisation of critical versus non-critical activities", "Assess regulatory reporting obligations"], "description": "A rapidly spreading illness causes 40% staff absence, disrupting critical operations.", "id": 4, "is_builtin": true, "name": "Pandemic / Mass Staff Absence", "sample_injects": ["Three members of the senior leadership team are absent simultaneously", "A key regulatory submission deadline falls within the exercise period", "A client requests evidence of business continuity arrangements", "Occupational Health recommends further protective measures", "Media enquiry about the organisation\u0027s response to the outbreak"]}, {"category": "Natural Disaster", "context": "Unprecedented rainfall causes flash flooding in the city centre. The primary office building is flooded to ground-floor level, all staff have been evacuated, and access is prohibited by emergency services. The situation is expected to persist for at least 5 days.", "default_objectives": ["Activate invocation of the Business Continuity Plan", "Test work-from-home and alternate-site arrangements", "Assess staff communication and welfare protocols", "Evaluate critical process recovery within RTO targets", "Test supplier and customer communication procedures"], "description": "Extreme rainfall causes flooding that renders the primary office inaccessible and damages infrastructure.", "id": 2, "is_builtin": true, "name": "Severe Flooding", "sample_injects": ["HR confirms 30% of staff cannot access the VPN", "A critical server room is flooded; primary data centre offline", "A key customer threatens contract cancellation due to service failure", "Local authority requests the building for use as an emergency shelter", "Media arrives outside the building"]}, {"category": "Reputational", "context": "A national newspaper publishes an expos\u00e9 alleging malpractice by a senior employee. Social media amplifies the story rapidly. The story is partially inaccurate but contains some factual elements. The CEO is overseas and unreachable for 4 hours.", "default_objectives": ["Test crisis communications and spokesperson protocols", "Assess social media monitoring and response procedures", "Evaluate escalation and decision-making in the absence of senior leadership", "Test legal and regulatory notification obligations", "Assess internal staff communication during a reputational event"], "description": "A damaging story about the organisation breaks in national media, requiring immediate crisis communications.", "id": 6, "is_builtin": true, "name": "Reputational Crisis", "sample_injects": ["Story goes viral with 10,000 social media mentions within 1 hour", "Three major clients call to request immediate reassurance", "Regulator contacts the compliance team for an urgent call", "The named employee contacts HR demanding to respond publicly", "A TV news crew arrives at head office"]}, {"category": "Supply Chain", "context": "The organisation\u0027s primary IT managed-service provider announces it has entered administration with immediate effect. All support contracts are suspended, and access to hosted systems may be withdrawn within 48 hours.", "default_objectives": ["Test third-party dependency identification and escalation", "Assess contingency arrangements for critical services", "Evaluate contract and legal response procedures", "Test communication to internal stakeholders and clients", "Identify alternative supplier options and onboarding speed"], "description": "A sole-source critical supplier enters administration, cutting off a key input to operations.", "id": 3, "is_builtin": true, "name": "Critical Supplier Failure", "sample_injects": ["Supplier confirms all SLAs are immediately suspended", "Hosted application credentials may be revoked within 24 hours", "Legal team identifies a data-custody clause requiring urgent action", "Alternative supplier identified but needs 5 days to mobilise", "Client SLA breach notification issued automatically"]}, {"category": "Technology", "context": "At 14:30 on a Tuesday, a power surge followed by a cooling failure causes an unplanned shutdown of the primary data centre. All production systems are offline. The DR site is available but failover has not been fully tested in 18 months.", "default_objectives": ["Test the IT Disaster Recovery Plan invocation", "Assess DR site failover procedures and timelines", "Evaluate internal and external communication protocols", "Test manual workaround procedures for critical processes", "Assess RTO/RPO achievement against targets"], "description": "An unplanned outage at the primary data centre takes all production systems offline.", "id": 5, "is_builtin": true, "name": "Data Centre Outage", "sample_injects": ["DR failover estimated to take 6 hours \u2014 RTO is 4 hours", "Customer-facing portal has been down for 2 hours; complaints escalating", "A regulatory transaction cut-off deadline is in 3 hours", "DR site network connectivity is intermittent", "Media pick up on the outage and request a statement"]}]

{"aim": "To evaluate Barwon Water\u0027s ability to effectively respond to and recover from a severe infrastructure failure involving damaged pipes, ensuring minimal disruption to critical water supply and wastewater management services.", "audit_findings": "", "builder_stage": 7, "business_impacts": [], "complexity": "moderate", "controls_to_test": "", "created_at": "2026-06-18T03:50:29.261780", "dependencies": [], "description": "", "discussion_breakpoints": true, "disruption_level": "Major crisis", "duration_minutes": 120, "evaluation_checklist": null, "exercise_category": null, "exercise_format": null, "exercise_type": "tabletop", "external_stakeholders": [], "facilitator_guide": null, "facilitator_name": null, "functions_in_scope": ["Risk / Compliance", "People \u0026 Culture / HR", "Cyber / Security", "Contact Centre", "Customer Operations", "External Agency Liaison", "Business Continuity", "Operations", "Facilities", "Finance", "Communications / PR"], "has_observers": false, "has_role_players": false, "hot_wash": true, "id": 232, "inject_cadence_minutes": 8, "inject_channels": ["Email", "Phone Call", "Teams / Slack"], "inject_count": 10, "injects_data": [{"branch_condition": null, "channel": "Email", "content": "Subject: Urgent: Sudden Drop in Water Pressure\n\nHi Team,\n\nWe\u0027ve detected a significant drop in water pressure in the main distribution line near the regional pumping station. Immediate investigation is required.\n\nBest,\nControl Room", "delivered_at": "2026-06-18T03:56:51.353372", "evaluation_criteria": "CMT is activated within 30 minutes of incident notification.", "exercise_id": 232, "expected_actions": "Crisis Management Team (CMT) activation and initial assessment of situation.", "facilitator_notes": "Prompt participants to initiate immediate site assessment.", "id": 265, "image_required": false, "inject_type": "information", "notes": "[POOR] ", "objective_links": [1], "phase_id": null, "phase_name": "Initial Alert", "recipient": "Operations Manager", "response": "", "sender": "Control Room", "sequence_number": 1, "status": "responded", "team_assignment": ["all"], "time_offset_minutes": 5, "title": "Initial Alert: Water Pressure Drop", "video_script": null, "video_status": "none", "video_talk_id": null, "video_ticker": null, "video_url": null}, {"branch_condition": null, "channel": "Phone Call", "content": "Field Engineer: We\u0027ve confirmed a major leak near the regional station. The pipes are severely damaged due to ground saturation. It looks like water contamination is possible.", "delivered_at": null, "evaluation_criteria": "Prompt escalation and initiation of contamination assessment.", "exercise_id": 232, "expected_actions": "Participants should escalate the issue and begin contamination risk assessment.", "facilitator_notes": "Highlight the potential contamination risk to escalate urgency.", "id": 266, "image_required": false, "inject_type": "escalation", "notes": null, "objective_links": [4, 5], "phase_id": null, "phase_name": "Situation Development", "recipient": "Operations Manager", "response": null, "sender": "Field Engineer", "sequence_number": 2, "status": "pending", "team_assignment": ["all"], "time_offset_minutes": 13, "title": "Site Assessment Update", "video_script": null, "video_status": "none", "video_talk_id": null, "video_ticker": null, "video_url": null}, {"branch_condition": null, "channel": "Teams / Slack", "content": "Heads up: The regulator just reached out. They want an update on the water supply issue within the next 2 hours. Need to coordinate our response.", "delivered_at": null, "evaluation_criteria": "Timely and accurate communication with the regulator.", "exercise_id": 232, "expected_actions": "Draft and approve a response to satisfy regulatory requirements.", "facilitator_notes": "Push for quick coordination of a response to the regulator.", "id": 267, "image_required": false, "inject_type": "comms", "notes": null, "objective_links": [2, 5], "phase_id": null, "phase_name": "Escalation", "recipient": "CMT", "response": null, "sender": "Regulatory Affairs", "sequence_number": 3, "status": "pending", "team_assignment": ["all"], "time_offset_minutes": 21, "title": "Regulator Inquiry", "video_script": null, "video_status": "none", "video_talk_id": null, "video_ticker": null, "video_url": null}, {"branch_condition": null, "channel": "Social Media Post", "content": "What\u0027s happening with our water? Pressure is low and tastes weird. @BarwonWater #WaterCrisis", "delivered_at": null, "evaluation_criteria": "Effective and consistent public communication addressing concerns.", "exercise_id": 232, "expected_actions": "Dispatch public communication team to address public concerns.", "facilitator_notes": "Increase pressure on public communications.", "id": 268, "image_required": false, "inject_type": "comms", "notes": null, "objective_links": [2], "phase_id": null, "phase_name": "Escalation", "recipient": "Public", "response": null, "sender": "Local Resident", "sequence_number": 4, "status": "pending", "team_assignment": ["all"], "time_offset_minutes": 29, "title": "Public Concern on Social Media", "video_script": null, "video_status": "none", "video_talk_id": null, "video_ticker": null, "video_url": null}, {"branch_condition": null, "channel": "Teams / Slack", "content": "We need to decide if a boil water notice is necessary. Possible contamination from the leak.", "delivered_at": null, "evaluation_criteria": "Timely and appropriate decision on issuing a public advisory.", "exercise_id": 232, "expected_actions": "Evaluate the need for a public safety advisory.", "facilitator_notes": "Force a decision on public safety measures.", "id": 269, "image_required": false, "inject_type": "decision", "notes": null, "objective_links": [4], "phase_id": null, "phase_name": "Complication", "recipient": "CMT", "response": null, "sender": "Health and Safety Lead", "sequence_number": 5, "status": "pending", "team_assignment": ["all"], "time_offset_minutes": 37, "title": "Internal Discussion on Contamination Risk", "video_script": null, "video_status": "none", "video_talk_id": null, "video_ticker": null, "video_url": null}, {"branch_condition": null, "channel": "Phone Call", "content": "Reporter: We\u0027ve heard about the water issue. What\u0027s being done to fix it? Is it safe to drink?", "delivered_at": null, "evaluation_criteria": "Consistent and factual media response.", "exercise_id": 232, "expected_actions": "Prepare and deliver a holding statement for the media.", "facilitator_notes": "Test the team\u0027s ability to handle media inquiries.", "id": 270, "image_required": false, "inject_type": "comms", "notes": null, "objective_links": [2], "phase_id": null, "phase_name": "External Pressure", "recipient": "Communications Lead", "response": null, "sender": "Local News Reporter", "sequence_number": 6, "status": "pending", "team_assignment": ["all"], "time_offset_minutes": 45, "title": "Media Interest", "video_script": null, "video_status": "none", "video_talk_id": null, "video_ticker": null, "video_url": null}, {"branch_condition": null, "channel": "Email", "content": "Subject: Urgent: Water Supply Issue\n\nDear Barwon Water,\n\nOur operations are severely impacted by the water supply issue. We need an immediate update on the expected restoration timeline.\n\nRegards,\nIndustrial Client", "delivered_at": null, "evaluation_criteria": "Effective and timely communication with industrial clients.", "exercise_id": 232, "expected_actions": "Communicate restoration plans and timelines to key industrial clients.", "facilitator_notes": "Increase pressure from key clients to prioritize restoration efforts.", "id": 271, "image_required": false, "inject_type": "comms", "notes": null, "objective_links": [2, 3], "phase_id": null, "phase_name": "Complication", "recipient": "Customer Service", "response": null, "sender": "Major Industrial Client", "sequence_number": 7, "status": "pending", "team_assignment": ["all"], "time_offset_minutes": 53, "title": "Industrial Client Escalation", "video_script": null, "video_status": "none", "video_talk_id": null, "video_ticker": null, "video_url": null}, {"branch_condition": null, "channel": "Executive Request", "content": "We need to consider water rationing for affected areas. Please provide an assessment of impact and feasibility.", "delivered_at": null, "evaluation_criteria": "Balanced decision on resource allocation with documented rationale.", "exercise_id": 232, "expected_actions": "Assess and propose a water rationing plan.", "facilitator_notes": "Drive decision-making on resource allocation.", "id": 272, "image_required": false, "inject_type": "decision", "notes": null, "objective_links": [4], "phase_id": null, "phase_name": "Decision Point", "recipient": "Operations Manager", "response": null, "sender": "Crisis Management Team Lead", "sequence_number": 8, "status": "pending", "team_assignment": ["all"], "time_offset_minutes": 61, "title": "Decision Time: Water Rationing", "video_script": null, "video_status": "none", "video_talk_id": null, "video_ticker": null, "video_url": null}, {"branch_condition": null, "channel": "Regulator Notice", "content": "Ref: 2023/09 Water Incident\n\nBarwon Water,\n\nPlease submit your incident report by end of business today, detailing the cause, impact, and mitigation actions. Non-compliance may result in penalties.\n\nRegards,\nWater Authority", "delivered_at": null, "evaluation_criteria": "Compliance with regulatory reporting obligations.", "exercise_id": 232, "expected_actions": "Compile and submit the required incident report to the regulator.", "facilitator_notes": "Ensure compliance with regulatory reporting requirements.", "id": 273, "image_required": false, "inject_type": "action", "notes": null, "objective_links": [5], "phase_id": null, "phase_name": "Decision Point", "recipient": "Regulatory Affairs", "response": null, "sender": "Water Authority", "sequence_number": 9, "status": "pending", "team_assignment": ["all"], "time_offset_minutes": 69, "title": "Stakeholder Pressure: Regulatory Deadline", "video_script": null, "video_status": "none", "video_talk_id": null, "video_ticker": null, "video_url": null}, {"branch_condition": null, "channel": "Teams / Slack", "content": "We\u0027ve started repairs on the damaged pipes. Let\u0027s plan for a gradual return to normal operations over the next 48 hours.", "delivered_at": null, "evaluation_criteria": "Effective initiation of recovery plans and communication of return-to-normal timelines.", "exercise_id": 232, "expected_actions": "Initiate recovery plans and communicate timelines for service restoration.", "facilitator_notes": "Transition focus to recovery and restoration of services.", "id": 274, "image_required": false, "inject_type": "action", "notes": null, "objective_links": [3], "phase_id": null, "phase_name": "Recovery Initiation", "recipient": "Business Recovery Teams", "response": null, "sender": "Operations Manager", "sequence_number": 10, "status": "pending", "team_assignment": ["all"], "time_offset_minutes": 77, "title": "Recovery Initiation: Return to Normal", "video_script": null, "video_status": "none", "video_talk_id": null, "video_ticker": null, "video_url": null}], "is_multi_team": false, "knowns_at_start": "- Water pressure has dropped significantly in the main pipeline.\n- A major leak is confirmed near the regional pumping station.\n- Initial impact on water supply to multiple communities is evident.\n- Crisis Management Team is activated.", "num_phases": 4, "objectives": [], "objectives_data": [{"capability_area": "Incident Escalation", "evaluation_method": "checklist", "exercise_id": 232, "id": 204, "objective_text": "Test the effectiveness of the Crisis Management Team\u0027s activation and initial response to the infrastructure failure.", "sequence_number": 1, "success_criteria": "CMT is activated within 30 minutes of incident notification; initial response actions are aligned with the crisis management plan."}, {"capability_area": "Crisis Communications", "evaluation_method": "checklist", "exercise_id": 232, "id": 205, "objective_text": "Validate the communication protocols and effectiveness of internal and external communications during the incident.", "sequence_number": 2, "success_criteria": "Communication to stakeholders, including regulators and customers, is initiated within predefined timeframes, with messages consistent and factual."}, {"capability_area": "Business Continuity Activation", "evaluation_method": "checklist", "exercise_id": 232, "id": 206, "objective_text": "Assess the ability of the Business Recovery Teams to implement continuity and recovery plans effectively.", "sequence_number": 3, "success_criteria": "Continuity plans are executed within the defined Recovery Time Objective (RTO) for critical services, and recovery actions are documented."}, {"capability_area": "Decision-Making", "evaluation_method": "checklist", "exercise_id": 232, "id": 207, "objective_text": "Evaluate decision-making processes and clarity of role responsibilities during the incident.", "sequence_number": 4, "success_criteria": "Decisions are made within appropriate authority levels, with clear documentation of decision rationale and role responsibilities."}, {"capability_area": "Regulatory And Legal", "evaluation_method": "checklist", "exercise_id": 232, "id": 208, "objective_text": "Confirm compliance with regulatory and legal obligations related to incident notification and response.", "sequence_number": 5, "success_criteria": "All regulatory notifications are completed within the prescribed timeframes, and compliance with relevant regional regulations is maintained."}], "organisation": null, "participants": [], "phases_data": [], "plans_to_test": [], "risk_alignment": "Risk that organisation is unable to respond to critical infrastructure failing (severely damaged pipes)", "scenario_assumptions": "- The exercise assumes no actual environmental hazard, and all communications are simulated.\n- External stakeholders such as regulatory bodies and media are simulated by the exercise control team.\n- All technical fixes are artificially accelerated for exercise purposes.", "scenario_category": "", "scenario_name": "", "scenario_narrative": "A severe weather event has caused unprecedented rainfall in the region served by Barwon Water. The excessive rain has led to the saturation of the ground, resulting in significant pressure on the underground water pipes. In the early morning hours, a critical section of the main water distribution pipes located near the regional pumping station sustains severe damage, leading to a major leak. This damages the flow of water supply to several key communities and industrial clients. The sudden loss of pressure is detected by the central control system, triggering alarms and alerts within the operations center. As the day progresses, the damage worsens, leading to potential contamination risks and heightened concerns over water quality. The situation requires immediate crisis management to ensure water supply continuity, manage public communication, and meet regulatory reporting obligations.", "scheduled_date": null, "scope_in": "", "scope_out": "", "status": "completed", "teams": ["alpha", "bravo", "charlie"], "title": "Severely damaged pipes", "trigger_event": "At 4:30 AM, the central operations system detects a significant drop in water pressure in the main pipeline servicing several key areas. Initial manual checks confirm the presence of a major leak due to pipe damage caused by ground saturation.", "unknowns_at_start": "- The full extent of the pipe damage and potential need for repairs.\n- The impact on water quality and potential contamination.\n- The time required to restore normal water supply.\n- The root cause of the pipe failure."}