Enterprise coordination
A critical supplier becomes the incident
A shared vendor disruption reaches several business units. Rehearse one coordination picture, independent evidence and executive updates.
20 minutes suggested · Four incident updates · One shared screen
Start this rehearsal →Watch the quick field guide
24-second visual guide · captions and transcript · no autoplay
Read the guidance transcript
Name what is affected. Read the fictional alert. Identify the business impact and what is still unknown; avoid jumping to a diagnosis.
Pick the next move. Compare recovery and communication options. Each choice changes the exercise narrative, not a real system.
Keep the room aligned. Use the timeline and decision log to agree one coordinator, one update and the next checkpoint.
Close the loop. Capture recovery assumptions and assign follow-up actions. Export the report so the learning outlives the meeting.
Who should be in the room?
Facilitator, Enterprise incident lead, Vendor owner, Business-unit leads. These are discussion roles, not account invitations. One person records while the team talks.
What the team will practice
Different teams hear different stories
A common supplier is not proof of a common failure mode or impact.
Discussion: Who assembles a shared impact picture and owns the vendor contact?
The vendor gives an optimistic estimate
An estimate is not verified recovery evidence.
Discussion: How do you coordinate continuity while separating supplier estimates from confirmed facts?
Executives want one answer
Multiple business owners need a consistent record without losing unit-specific impact.
Discussion: What belongs in the shared update and who can approve it?
One business unit recovers first
Enterprise closure needs evidence from affected units, not only a vendor declaration.
Discussion: Who verifies recovery and owns supplier-risk follow-through?
What you’ll leave with
Your own recorded decisions, uncertainties and improvement actions with owners, dates and status. Print a readable report or export a browser-local session to revisit.
Original fictional content, not a technical response procedure. No real systems are changed. This exercise does not certify security readiness or compliance.
Read the facilitator guide →