Disaster Recovery Readiness Exercise · Instructions
Assume Nothing.
It is 2:07 on a Sunday morning. Find the gap between what your plan says and what your room can actually do — before something else finds it for you.
Quick start
Ten minutes from an empty room to the first alert.
Start a session.
On the home page, enter your name, how many people are playing, and how long you have. Tick what you most want out of it. Press “Create the session”.
Put the wall on the big screen.
Your lobby has a link to the wall screen. Open it on the projector or the meeting-room display. It is the room’s shared picture, and your controls live there.
Read the six-character code out loud.
Everyone else goes to the same address on their own laptop or phone, types the code under “Join a session”, enters a first name and picks the seat closest to what they really do.
Let people answer honestly.
Before anything happens, each seat says what the company actually has today — tested, written down, assumed, not sure, or not in place. Nobody else sees these answers during the exercise.
Press “Begin the exercise”.
It needs at least two seats filled. Everyone moves into Act I together, and you move to the wall.
Let it run, and let them talk.
Acts move on by themselves when their time is up. Use Pause whenever the room needs to argue something out — that argument is the point.
End it, then fix Monday.
When the last act finishes, the wall takes the room to the debrief. Agree actions while everyone is still there: each needs a named person and a date.
What this is
A tabletop exercise your team plays together, each person on their own screen, with one shared screen for the room. A ransomware attack unfolds over several days of compressed time at a fictional hospital group. Each person receives only the information their role would really receive, and the team has to put the picture together out loud.
There is no pass mark, and it is not a test of anyone in the room. It is looking for the difference between what the plan says and what the team can do at two in the morning. Saying “we don’t have that” never scores worse than guessing — the report credits it. The one answer that does score worst is no answer at all.
Who does what
The facilitator
Whoever creates the session. You do not hold a seat or make the team’s decisions. You run the wall screen, where you can pause the clock, move to the next act, play the Curveball, and end the exercise — and delete the session and everything in it at any time. If you do nothing at all, the exercise still paces itself.
The attacker — optional, 5+ people
One person may play the adversary. They take no part in the response. They see which capabilities the company left open — never who said so — and choose which complication lands, and when. They have one to spend, or two in a three-hour session.
With five or more people, each area gets its own seat. With four or fewer the same work is bundled into four: Command & Business, Infrastructure & Network, Security & Identity, and Applications & Data. A seat nobody takes is not skipped — its work falls to the nearest filled seat, and the report notes it.
Incident Commander
Runs the bridge, keeps the order of work straight, decides when this becomes a declared disaster, and is the link to the executives.
Infrastructure & Cloud
Servers, cloud, storage, the building’s own systems — and the backups every other recovery depends on.
Network & Connectivity
Carriers, segmentation between sites, and whether the recovery site’s link can carry the load.
Security
Identity, endpoints, containment, and preserving the forensic trail.
Applications & Data
The systems the business actually runs on, their databases, and the pipelines that build them.
Risk & Compliance
Regulators, notification clocks, and the conditions the insurer attaches to everything.
Business & Communications
Staff, customers, the press, and the channel everyone is talking on.
Finance
Paying for the response under pressure, plus every vendor and contract you will need.
How it runs
Your private feed
Alerts, calls, emails and messages arrive on your own screen. Nobody else sees them. Most only make sense beside something another seat is holding, so say what you are seeing. Anything marked can be pinned to the situation board, which everyone sees, on their own screen and on the wall.
Decisions
Some calls belong to one seat, and only that seat can make them. Each option states its trade-off and costs capacity — your people’s attention and hours, not the data centre’s. Below 40, recovery takes 25% longer. Once confirmed, a decision stays on your screen as a record.
Private questions
From time to time everyone is asked the same question and answers privately — “who has the authority to declare a disaster?”. When the facilitator opens it, the answers are shown together without names. Where they differ is usually the most useful thing the room learns all day.
Find it in your plan
Occasionally a seat is asked to find a real page in your real plan, in a few minutes. Found it, found it but it is out of date, or could not find it — all three are useful, and it is a test of the plan, not of the person looking.
The Curveball
One complication is held back and played at a bad moment, by the facilitator, the attacker, or the app. It is never arbitrary: each one is only available if the weakness it exploits is genuinely yours.
If you go quiet
If something of yours has been waiting a few minutes, you get a private prompt on your own screen. Nobody else sees it, and the wall never names anyone — it only ever asks the whole room whether everyone has shared what they are seeing.
The wall. The shared screen shows the company’s sites and critical systems as they degrade, fail and come back; how long you have been down against your own target; how much data is at risk; the team’s capacity; and the situation board, newest first.
How long to book
Three short acts and a ten-minute debrief. The main line: detect, contain, restore, communicate. Right for a first run or a leadership team.
Three full acts and a twenty-minute debrief. Adds the data theft and extortion, and the regulator and the insurer. More for every seat in every act.
Adds a fourth act, “Return to Normal” — failing back, rebuilding trust, and what the board funds next — plus the supplier thread and a second Curveball.
A longer session is the same story told deeper, not a different game. Time in the exercise runs much faster than the clock on the wall: the first act covers one hour, the last covers days.
What you leave with
The debrief
“What We Fix Monday”. Where the room disagreed, starting with what you said you came for, and an action register. An action will not save without a named person and a date.
The after-action report
A rating — Developing, Established or Proven — across seven areas, your recovery targets against what your restore path can really deliver, and what held and what did not. Every finding says whether the exercise watched it happen or you told us. It prints to PDF.
The game film
A replay of what each seat knew, and when, side by side. Private answers stay anonymous. It opens only once the exercise is over.
Event mode
For dinners, roundtables and conference sessions where the people at the table work for different companies. Everyone plays a fictional company; each seat is handed a short dossier instead of being asked about their own employer, so play starts in two minutes.
Nothing about any real organization is asked for or stored. Each person leaves with five questions to take back to their own team.
What makes a session good
Talk. The screens are prompts. A silent room clicking well has missed the point.
Answer for today not for how the plan says it should be.
Pause freely. If an argument breaks out about who is allowed to decide something, stop the clock and have it.
Sit in your real role. The report is only about your company if the seats are.
Do not rescue people. If somebody cannot find the page in the plan, that is the finding.
Your answers and the team’s notes form the after-action report, and Expedient can see the report and notes for a session. The facilitator can delete a session and all of its data at any time.
