Exercise Builder

null

[{"category": "Cyber", "context": "At 07:45 on a Monday morning the IT helpdesk begins receiving reports of encrypted files and ransom notes appearing on workstations across two sites. Core business applications are unavailable. The attacker demands payment within 72 hours or threatens to publish exfiltrated data.", "default_objectives": ["Activate and test the Cyber Incident Response Plan", "Assess communication and escalation protocols", "Evaluate decision-making under time pressure", "Test data recovery and system restoration procedures", "Assess third-party and regulatory notification processes"], "description": "Critical systems are encrypted by ransomware, threatening operational continuity and data integrity.", "id": 1, "is_builtin": true, "name": "Ransomware Attack", "sample_injects": ["IT team confirms 60% of servers are encrypted", "Ransom demand of $2M received via email", "Media outlet contacts PR team for comment", "Regulator requests a status update within 4 hours", "Backup systems found to also be compromised", "Key supplier reports they cannot receive orders"]}, {"category": "Health \u0026 Safety", "context": "A respiratory illness has spread rapidly within the workforce. Within 72 hours, 40% of staff across all departments are absent. Public health guidance recommends isolation for close contacts. No immediate end to the outbreak is in sight.", "default_objectives": ["Test people resilience and cross-training coverage", "Assess remote-working and reduced-capacity operating procedures", "Evaluate staff welfare and communication channels", "Test prioritisation of critical versus non-critical activities", "Assess regulatory reporting obligations"], "description": "A rapidly spreading illness causes 40% staff absence, disrupting critical operations.", "id": 4, "is_builtin": true, "name": "Pandemic / Mass Staff Absence", "sample_injects": ["Three members of the senior leadership team are absent simultaneously", "A key regulatory submission deadline falls within the exercise period", "A client requests evidence of business continuity arrangements", "Occupational Health recommends further protective measures", "Media enquiry about the organisation\u0027s response to the outbreak"]}, {"category": "Natural Disaster", "context": "Unprecedented rainfall causes flash flooding in the city centre. The primary office building is flooded to ground-floor level, all staff have been evacuated, and access is prohibited by emergency services. The situation is expected to persist for at least 5 days.", "default_objectives": ["Activate invocation of the Business Continuity Plan", "Test work-from-home and alternate-site arrangements", "Assess staff communication and welfare protocols", "Evaluate critical process recovery within RTO targets", "Test supplier and customer communication procedures"], "description": "Extreme rainfall causes flooding that renders the primary office inaccessible and damages infrastructure.", "id": 2, "is_builtin": true, "name": "Severe Flooding", "sample_injects": ["HR confirms 30% of staff cannot access the VPN", "A critical server room is flooded; primary data centre offline", "A key customer threatens contract cancellation due to service failure", "Local authority requests the building for use as an emergency shelter", "Media arrives outside the building"]}, {"category": "Reputational", "context": "A national newspaper publishes an expos\u00e9 alleging malpractice by a senior employee. Social media amplifies the story rapidly. The story is partially inaccurate but contains some factual elements. The CEO is overseas and unreachable for 4 hours.", "default_objectives": ["Test crisis communications and spokesperson protocols", "Assess social media monitoring and response procedures", "Evaluate escalation and decision-making in the absence of senior leadership", "Test legal and regulatory notification obligations", "Assess internal staff communication during a reputational event"], "description": "A damaging story about the organisation breaks in national media, requiring immediate crisis communications.", "id": 6, "is_builtin": true, "name": "Reputational Crisis", "sample_injects": ["Story goes viral with 10,000 social media mentions within 1 hour", "Three major clients call to request immediate reassurance", "Regulator contacts the compliance team for an urgent call", "The named employee contacts HR demanding to respond publicly", "A TV news crew arrives at head office"]}, {"category": "Supply Chain", "context": "The organisation\u0027s primary IT managed-service provider announces it has entered administration with immediate effect. All support contracts are suspended, and access to hosted systems may be withdrawn within 48 hours.", "default_objectives": ["Test third-party dependency identification and escalation", "Assess contingency arrangements for critical services", "Evaluate contract and legal response procedures", "Test communication to internal stakeholders and clients", "Identify alternative supplier options and onboarding speed"], "description": "A sole-source critical supplier enters administration, cutting off a key input to operations.", "id": 3, "is_builtin": true, "name": "Critical Supplier Failure", "sample_injects": ["Supplier confirms all SLAs are immediately suspended", "Hosted application credentials may be revoked within 24 hours", "Legal team identifies a data-custody clause requiring urgent action", "Alternative supplier identified but needs 5 days to mobilise", "Client SLA breach notification issued automatically"]}, {"category": "Technology", "context": "At 14:30 on a Tuesday, a power surge followed by a cooling failure causes an unplanned shutdown of the primary data centre. All production systems are offline. The DR site is available but failover has not been fully tested in 18 months.", "default_objectives": ["Test the IT Disaster Recovery Plan invocation", "Assess DR site failover procedures and timelines", "Evaluate internal and external communication protocols", "Test manual workaround procedures for critical processes", "Assess RTO/RPO achievement against targets"], "description": "An unplanned outage at the primary data centre takes all production systems offline.", "id": 5, "is_builtin": true, "name": "Data Centre Outage", "sample_injects": ["DR failover estimated to take 6 hours \u2014 RTO is 4 hours", "Customer-facing portal has been down for 2 hours; complaints escalating", "A regulatory transaction cut-off deadline is in 3 hours", "DR site network connectivity is intermittent", "Media pick up on the outage and request a statement"]}]

{"aim": null, "audit_findings": null, "builder_stage": 1, "business_impacts": [], "complexity": "moderate", "controls_to_test": null, "created_at": "2026-06-26T00:59:48.126141", "dependencies": [], "description": "The CFO has been arrested and charge with Fraud. There could be significant impact to Barwon water and they will need to do a full review of accounts to understand what has happened.", "discussion_breakpoints": true, "disruption_level": null, "duration_minutes": 120, "evaluation_checklist": null, "exercise_category": null, "exercise_format": null, "exercise_type": "tabletop", "external_stakeholders": [], "facilitator_guide": null, "facilitator_name": null, "functions_in_scope": [], "has_observers": false, "has_role_players": false, "hot_wash": true, "id": 299, "inject_cadence_minutes": 8, "inject_channels": [], "inject_count": 12, "injects_data": [{"branch_condition": null, "channel": "Email", "content": "Subject: Urgent - CFO Arrested for Fraud\n\nTeam,\n\nThis morning, our CFO was arrested on charges of financial fraud. We need to convene an emergency meeting to address the potential impacts on our operations and public image.\n\nPlease prioritize attendance.\n\nRegards,\nCEO", "delivered_at": "2026-06-26T01:01:15.128938", "evaluation_criteria": "Meeting is held promptly with all key personnel present.", "exercise_id": 299, "expected_actions": "Crisis Management Team convenes an emergency meeting within 30 minutes.", "facilitator_notes": null, "id": 341, "image_required": false, "inject_type": "information", "notes": "", "objective_links": [], "phase_id": null, "phase_name": null, "recipient": "Crisis Management Team", "response": "", "sender": "CEO", "sequence_number": 1, "status": "responded", "team_assignment": ["all"], "time_offset_minutes": 0, "title": "Initial Alert: CFO Arrested", "video_script": null, "video_status": "none", "video_talk_id": null, "video_ticker": null, "video_url": null}, {"branch_condition": null, "channel": "Phone Call", "content": "Q: \u0027Is it true that your CFO has been arrested for fraud?\u0027 \u2192 We are currently assessing the situation and will provide an update shortly.", "delivered_at": "2026-06-26T01:02:12.218846", "evaluation_criteria": "Holding statement issued within 30 minutes, following crisis comms guidelines.", "exercise_id": 299, "expected_actions": "Prepare and issue a holding statement to the media.", "facilitator_notes": null, "id": 342, "image_required": false, "inject_type": "comms", "notes": null, "objective_links": [], "phase_id": null, "phase_name": null, "recipient": "Communications Lead", "response": null, "sender": "Journalist", "sequence_number": 2, "status": "delivered", "team_assignment": ["bravo"], "time_offset_minutes": 15, "title": "Media Inquiry", "video_script": null, "video_status": "none", "video_talk_id": null, "video_ticker": null, "video_url": null}, {"branch_condition": null, "channel": "Email", "content": "Subject: Immediate Financial Review Required\n\nFinance Team,\n\nIn light of recent events, initiate a comprehensive review of all financial accounts and transactions from the past 18 months. Report findings to the crisis team ASAP.\n\nThanks,\nInterim CFO", "delivered_at": null, "evaluation_criteria": "Audit initiated promptly with progress updates provided to the crisis team.", "exercise_id": 299, "expected_actions": "Finance team begins immediate audit of financial records.", "facilitator_notes": null, "id": 343, "image_required": false, "inject_type": "action", "notes": null, "objective_links": [], "phase_id": null, "phase_name": null, "recipient": "Finance Team", "response": null, "sender": "Interim CFO", "sequence_number": 3, "status": "pending", "team_assignment": ["charlie"], "time_offset_minutes": 30, "title": "Financial Review Request", "video_script": null, "video_status": "none", "video_talk_id": null, "video_ticker": null, "video_url": null}, {"branch_condition": null, "channel": "Teams / Slack", "content": "We need to notify the FCA and ICO of the incident within regulatory timeframes. Ensure compliance to avoid penalties.", "delivered_at": null, "evaluation_criteria": "Notifications sent within required timeframes, documentation logged.", "exercise_id": 299, "expected_actions": "Notify FCA and ICO within regulatory windows.", "facilitator_notes": null, "id": 344, "image_required": false, "inject_type": "escalation", "notes": null, "objective_links": [], "phase_id": null, "phase_name": null, "recipient": "Crisis Management Team", "response": null, "sender": "Regulatory Affairs", "sequence_number": 4, "status": "pending", "team_assignment": ["alpha"], "time_offset_minutes": 45, "title": "Regulatory Notification", "video_script": null, "video_status": "none", "video_talk_id": null, "video_ticker": null, "video_url": null}, {"branch_condition": null, "channel": "Email", "content": "Subject: Concerns from Major Shareholder\n\nHi Team,\n\nWe\u0027re receiving inquiries from major shareholders about the CFO\u0027s arrest. They are requesting an urgent update on how this affects their investments.\n\nBest,\nInvestor Relations", "delivered_at": null, "evaluation_criteria": "Shareholder communication sent promptly, with appropriate reassurances included.", "exercise_id": 299, "expected_actions": "Draft and send a communication to reassure shareholders.", "facilitator_notes": null, "id": 345, "image_required": false, "inject_type": "comms", "notes": null, "objective_links": [], "phase_id": null, "phase_name": null, "recipient": "Crisis Management Team", "response": null, "sender": "Investor Relations", "sequence_number": 5, "status": "pending", "team_assignment": ["bravo"], "time_offset_minutes": 60, "title": "Stakeholder Concern", "video_script": null, "video_status": "none", "video_talk_id": null, "video_ticker": null, "video_url": null}, {"branch_condition": null, "channel": "Teams / Slack", "content": "Rumors are circulating on the internal chat about the CFO\u0027s arrest. Staff are worried about job security.", "delivered_at": null, "evaluation_criteria": "Internal memo issued within 30 minutes, addressing concerns effectively.", "exercise_id": 299, "expected_actions": "Issue an internal memo addressing staff concerns and reinforcing job security.", "facilitator_notes": null, "id": 346, "image_required": false, "inject_type": "comms", "notes": null, "objective_links": [], "phase_id": null, "phase_name": null, "recipient": "All Staff", "response": null, "sender": "HR Director", "sequence_number": 6, "status": "pending", "team_assignment": ["charlie"], "time_offset_minutes": 75, "title": "Internal Staff Rumors", "video_script": null, "video_status": "none", "video_talk_id": null, "video_ticker": null, "video_url": null}, {"branch_condition": null, "channel": "Email", "content": "IT has detected unusual access patterns in the CFO\u0027s accounts. Possible data breach linked to the fraud investigation.", "delivered_at": null, "evaluation_criteria": "Investigation initiated quickly, with findings reported to the crisis team.", "exercise_id": 299, "expected_actions": "Investigate the potential data breach and assess the impact.", "facilitator_notes": null, "id": 347, "image_required": false, "inject_type": "escalation", "notes": null, "objective_links": [], "phase_id": null, "phase_name": null, "recipient": "Crisis Management Team", "response": null, "sender": "IT Security", "sequence_number": 7, "status": "pending", "team_assignment": ["alpha"], "time_offset_minutes": 90, "title": "Complication: Data Breach Suspected", "video_script": null, "video_status": "none", "video_talk_id": null, "video_ticker": null, "video_url": null}, {"branch_condition": null, "channel": "Phone Call", "content": "We need to consult with legal to understand the implications of the CFO\u0027s arrest and any potential liability.", "delivered_at": null, "evaluation_criteria": "Legal consultation arranged and documented, with advice shared with the crisis team.", "exercise_id": 299, "expected_actions": "Engage legal counsel for advice on managing potential liabilities.", "facilitator_notes": null, "id": 348, "image_required": false, "inject_type": "decision", "notes": null, "objective_links": [], "phase_id": null, "phase_name": null, "recipient": "Legal Counsel", "response": null, "sender": "Crisis Management Team", "sequence_number": 8, "status": "pending", "team_assignment": ["all"], "time_offset_minutes": 100, "title": "Legal Consultation", "video_script": null, "video_status": "none", "video_talk_id": null, "video_ticker": null, "video_url": null}, {"branch_condition": null, "channel": "Internal Memo", "content": "Begin planning for recovery and return to normal operations, considering any long-term impacts.", "delivered_at": null, "evaluation_criteria": "Recovery plan drafted with input from all relevant departments, presented to the crisis team.", "exercise_id": 299, "expected_actions": "Develop a recovery plan with clear steps for resuming normal operations.", "facilitator_notes": null, "id": 349, "image_required": false, "inject_type": "action", "notes": null, "objective_links": [], "phase_id": null, "phase_name": null, "recipient": "All Departments", "response": null, "sender": "Crisis Management Team", "sequence_number": 9, "status": "pending", "team_assignment": ["all"], "time_offset_minutes": 110, "title": "Recovery Planning", "video_script": null, "video_status": "none", "video_talk_id": null, "video_ticker": null, "video_url": null}, {"branch_condition": null, "channel": "Verbal", "content": "Conduct a hot debrief to capture immediate lessons learned and areas for improvement.", "delivered_at": null, "evaluation_criteria": "Debrief conducted, with key findings and action items documented.", "exercise_id": 299, "expected_actions": "Facilitate a structured debrief session to gather insights from all participants.", "facilitator_notes": null, "id": 350, "image_required": false, "inject_type": "action", "notes": null, "objective_links": [], "phase_id": null, "phase_name": null, "recipient": "All Participants", "response": null, "sender": "Exercise Facilitator", "sequence_number": 10, "status": "pending", "team_assignment": ["all"], "time_offset_minutes": 120, "title": "Hot Debrief", "video_script": null, "video_status": "none", "video_talk_id": null, "video_ticker": null, "video_url": null}, {"branch_condition": "", "channel": "radio", "content": "In breaking news, a very concerned Barwon Water customer has called into our show this morning. They expressed their anger over the lack of transparency and timely communication from Barwon Water regarding the recent arrest of their CFO. The caller is demanding immediate answers and reassurances about the security of their water supply and the financial stability of the organization. We will be following this story closely and bringing you updates as they come.", "delivered_at": null, "evaluation_criteria": "Assess the timeliness and effectiveness of the organization\u0027s public communication in response to the broadcast; evaluate the ability to manage public perception and mitigate reputational damage.", "exercise_id": 299, "expected_actions": "Activate crisis communications team to address public concerns; prepare and issue a press release; monitor media channels for further developments.", "facilitator_notes": "", "id": 351, "image_required": false, "inject_type": "information", "notes": null, "objective_links": [], "phase_id": null, "phase_name": "", "recipient": "Radio Station", "response": null, "sender": "", "sequence_number": 11, "status": "pending", "team_assignment": ["all"], "time_offset_minutes": 0, "title": "Customer Outrage Broadcasted", "video_script": null, "video_status": "none", "video_talk_id": null, "video_ticker": null, "video_url": null}, {"branch_condition": "", "channel": "News Bulletin", "content": "Victoria\u0027s regional water provider, Barwon Water, is under scrutiny as the investigation into CFO John Doe\u0027s fraud charges deepens. Authorities suggest that the financial discrepancies may be more extensive than initially reported, potentially affecting multiple service areas. The organisation is urged to maintain vigilance as the inquiry progresses.", "delivered_at": "2026-06-26T01:15:02.979924", "evaluation_criteria": "Participants should demonstrate proactive media monitoring and develop a coherent communication plan. Responses should be timely and mitigate potential reputational damage.", "exercise_id": 299, "expected_actions": "Monitor media coverage and prepare a communication strategy to address public and stakeholder inquiries. Ensure internal stakeholders are informed and aligned on messaging.", "facilitator_notes": "", "id": 352, "image_required": false, "inject_type": "information", "notes": null, "objective_links": [], "phase_id": null, "phase_name": "", "recipient": "", "response": null, "sender": "", "sequence_number": 12, "status": "delivered", "team_assignment": ["bravo"], "time_offset_minutes": 0, "title": "Breaking News: CFO Fraud Investigation Intensifies", "video_script": "Breaking news this hour: The investigation into Barwon Water\u0027s Chief Financial Officer, John Doe, has intensified. Authorities are uncovering more extensive financial discrepancies than initially reported. These discrepancies may impact multiple service areas within Victoria\u0027s regional water provider. Barwon Water is under pressure to remain vigilant as the inquiry continues. Customers are advised to stay informed about any potential service disruptions. This unfolding situation highlights the importance of robust financial oversight in public utilities. We will continue to bring you updates as they develop. Live from the newsroom, I\u0027m BC Studio Correspondent, BC Studio News.", "video_status": "ready", "video_talk_id": "clp_qF0xV2ZiS0mO8apKZ8gjb", "video_ticker": "Barwon Water CFO fraud probe deepens financial discrepancies may affect multiple service areas authorities warn", "video_url": "/api/video/inject/352"}], "is_multi_team": true, "knowns_at_start": null, "num_phases": 4, "objectives": ["Assess the effectiveness of the crisis management team activation process", "Evaluate the organization\u0027s communication strategy with stakeholders", "Determine the ability to conduct a rapid financial review and risk assessment", "Test compliance with regulatory notification requirements", "Analyze decision-making and leadership effectiveness under crisis conditions"], "objectives_data": [], "organisation": null, "participants": [], "phases_data": [], "plans_to_test": [], "risk_alignment": null, "scenario_assumptions": null, "scenario_category": "Crisis Management", "scenario_name": "Fraud Incident", "scenario_narrative": null, "scheduled_date": null, "scope_in": null, "scope_out": null, "status": "planned", "teams": ["alpha", "bravo", "charlie"], "title": "Fraud Incident", "trigger_event": null, "unknowns_at_start": null}