Exercise Builder

null

[{"category": "Cyber", "context": "At 07:45 on a Monday morning the IT helpdesk begins receiving reports of encrypted files and ransom notes appearing on workstations across two sites. Core business applications are unavailable. The attacker demands payment within 72 hours or threatens to publish exfiltrated data.", "default_objectives": ["Activate and test the Cyber Incident Response Plan", "Assess communication and escalation protocols", "Evaluate decision-making under time pressure", "Test data recovery and system restoration procedures", "Assess third-party and regulatory notification processes"], "description": "Critical systems are encrypted by ransomware, threatening operational continuity and data integrity.", "id": 1, "is_builtin": true, "name": "Ransomware Attack", "sample_injects": ["IT team confirms 60% of servers are encrypted", "Ransom demand of $2M received via email", "Media outlet contacts PR team for comment", "Regulator requests a status update within 4 hours", "Backup systems found to also be compromised", "Key supplier reports they cannot receive orders"]}, {"category": "Health \u0026 Safety", "context": "A respiratory illness has spread rapidly within the workforce. Within 72 hours, 40% of staff across all departments are absent. Public health guidance recommends isolation for close contacts. No immediate end to the outbreak is in sight.", "default_objectives": ["Test people resilience and cross-training coverage", "Assess remote-working and reduced-capacity operating procedures", "Evaluate staff welfare and communication channels", "Test prioritisation of critical versus non-critical activities", "Assess regulatory reporting obligations"], "description": "A rapidly spreading illness causes 40% staff absence, disrupting critical operations.", "id": 4, "is_builtin": true, "name": "Pandemic / Mass Staff Absence", "sample_injects": ["Three members of the senior leadership team are absent simultaneously", "A key regulatory submission deadline falls within the exercise period", "A client requests evidence of business continuity arrangements", "Occupational Health recommends further protective measures", "Media enquiry about the organisation\u0027s response to the outbreak"]}, {"category": "Natural Disaster", "context": "Unprecedented rainfall causes flash flooding in the city centre. The primary office building is flooded to ground-floor level, all staff have been evacuated, and access is prohibited by emergency services. The situation is expected to persist for at least 5 days.", "default_objectives": ["Activate invocation of the Business Continuity Plan", "Test work-from-home and alternate-site arrangements", "Assess staff communication and welfare protocols", "Evaluate critical process recovery within RTO targets", "Test supplier and customer communication procedures"], "description": "Extreme rainfall causes flooding that renders the primary office inaccessible and damages infrastructure.", "id": 2, "is_builtin": true, "name": "Severe Flooding", "sample_injects": ["HR confirms 30% of staff cannot access the VPN", "A critical server room is flooded; primary data centre offline", "A key customer threatens contract cancellation due to service failure", "Local authority requests the building for use as an emergency shelter", "Media arrives outside the building"]}, {"category": "Reputational", "context": "A national newspaper publishes an expos\u00e9 alleging malpractice by a senior employee. Social media amplifies the story rapidly. The story is partially inaccurate but contains some factual elements. The CEO is overseas and unreachable for 4 hours.", "default_objectives": ["Test crisis communications and spokesperson protocols", "Assess social media monitoring and response procedures", "Evaluate escalation and decision-making in the absence of senior leadership", "Test legal and regulatory notification obligations", "Assess internal staff communication during a reputational event"], "description": "A damaging story about the organisation breaks in national media, requiring immediate crisis communications.", "id": 6, "is_builtin": true, "name": "Reputational Crisis", "sample_injects": ["Story goes viral with 10,000 social media mentions within 1 hour", "Three major clients call to request immediate reassurance", "Regulator contacts the compliance team for an urgent call", "The named employee contacts HR demanding to respond publicly", "A TV news crew arrives at head office"]}, {"category": "Supply Chain", "context": "The organisation\u0027s primary IT managed-service provider announces it has entered administration with immediate effect. All support contracts are suspended, and access to hosted systems may be withdrawn within 48 hours.", "default_objectives": ["Test third-party dependency identification and escalation", "Assess contingency arrangements for critical services", "Evaluate contract and legal response procedures", "Test communication to internal stakeholders and clients", "Identify alternative supplier options and onboarding speed"], "description": "A sole-source critical supplier enters administration, cutting off a key input to operations.", "id": 3, "is_builtin": true, "name": "Critical Supplier Failure", "sample_injects": ["Supplier confirms all SLAs are immediately suspended", "Hosted application credentials may be revoked within 24 hours", "Legal team identifies a data-custody clause requiring urgent action", "Alternative supplier identified but needs 5 days to mobilise", "Client SLA breach notification issued automatically"]}, {"category": "Technology", "context": "At 14:30 on a Tuesday, a power surge followed by a cooling failure causes an unplanned shutdown of the primary data centre. All production systems are offline. The DR site is available but failover has not been fully tested in 18 months.", "default_objectives": ["Test the IT Disaster Recovery Plan invocation", "Assess DR site failover procedures and timelines", "Evaluate internal and external communication protocols", "Test manual workaround procedures for critical processes", "Assess RTO/RPO achievement against targets"], "description": "An unplanned outage at the primary data centre takes all production systems offline.", "id": 5, "is_builtin": true, "name": "Data Centre Outage", "sample_injects": ["DR failover estimated to take 6 hours \u2014 RTO is 4 hours", "Customer-facing portal has been down for 2 hours; complaints escalating", "A regulatory transaction cut-off deadline is in 3 hours", "DR site network connectivity is intermittent", "Media pick up on the outage and request a statement"]}]

{"aim": "To evaluate Barwon Water\u0027s ability to manage a wastewater management failure while ensuring minimal disruption to services and compliance with regulatory requirements.", "audit_findings": null, "builder_stage": 7, "business_impacts": ["Customer Impact", "Service Outage", "Reputational Impact"], "complexity": "moderate", "controls_to_test": null, "created_at": "2026-06-01T08:10:49.373603", "dependencies": [], "description": "", "discussion_breakpoints": true, "disruption_level": null, "duration_minutes": 120, "evaluation_checklist": null, "exercise_category": null, "exercise_format": null, "exercise_type": "tabletop", "external_stakeholders": ["Regulator", "Media"], "facilitator_guide": null, "facilitator_name": null, "functions_in_scope": ["Executive / Crisis Management Team", "Communications / PR", "Business Continuity"], "has_observers": false, "has_role_players": false, "hot_wash": true, "id": 1, "inject_cadence_minutes": 8, "inject_channels": ["Email", "Phone Call", "Teams / Slack"], "inject_count": 12, "injects_data": [{"branch_condition": "", "channel": "email", "content": "Alert: A malfunction has been detected in the wastewater management system. Initial reports indicate untreated wastewater is being released into the Barwon River.", "delivered_at": "2026-06-09T07:45:59.868502", "evaluation_criteria": "Timeliness and accuracy of team convening and initial notifications.", "exercise_id": 1, "expected_actions": "Initiate emergency notification procedures and convene the Crisis Management Team.", "facilitator_notes": "Introduce confusion by providing incomplete information. Observe initial response actions.", "id": 1, "image_required": false, "inject_type": "information", "notes": null, "objective_links": [1], "phase_id": 1, "phase_name": "Initial Failure Detection", "recipient": "Crisis Management Team", "response": null, "sender": "Geelong Treatment Plant Control", "sequence_number": 1, "status": "delivered", "team_assignment": ["all"], "time_offset_minutes": 5, "title": "Initial System Alert", "video_script": null, "video_status": "none", "video_talk_id": null, "video_ticker": null, "video_url": null}, {"branch_condition": "", "channel": "radio", "content": "The untreated wastewater is leading to significant environmental impact. High levels of pollutants detected downstream. People are starting to notice and they are not happy about this.", "delivered_at": "2026-06-09T07:46:13.677921", "evaluation_criteria": "Appropriate escalation to regulators and initiation of environmental assessment.", "exercise_id": 1, "expected_actions": "Escalate to relevant regulatory bodies and assess environmental impact.", "facilitator_notes": "Highlight the potential regulatory and environmental impacts. Test escalation protocols.", "id": 2, "image_required": true, "inject_type": "escalation", "notes": null, "objective_links": [2], "phase_id": 2, "phase_name": "Escalation and Impact Assessment", "recipient": "Executive Team", "response": null, "sender": "Citizen", "sequence_number": 2, "status": "delivered", "team_assignment": ["all"], "time_offset_minutes": 25, "title": "Environmental Impact Report", "video_script": null, "video_status": "none", "video_talk_id": null, "video_ticker": null, "video_url": null}, {"branch_condition": null, "channel": "Teams / Slack", "content": "Social media is abuzz with concerns about water safety. Hashtags #BarwonWaterFail and #RiverPollution trending.", "delivered_at": "2026-06-09T07:46:21.029077", "evaluation_criteria": "Effectiveness and timeliness of social media response and holding statement issuance.", "exercise_id": 1, "expected_actions": "Draft and release a holding statement addressing public concerns.", "facilitator_notes": "Observe how the team manages public perception and social media engagement.", "id": 3, "image_required": false, "inject_type": "comms", "notes": null, "objective_links": [3], "phase_id": 3, "phase_name": "Crisis Communication", "recipient": "Crisis Management Team", "response": null, "sender": "Communications Team", "sequence_number": 3, "status": "delivered", "team_assignment": ["all"], "time_offset_minutes": 55, "title": "Social Media Backlash", "video_script": null, "video_status": "none", "video_talk_id": null, "video_ticker": null, "video_url": null}, {"branch_condition": null, "channel": "Email", "content": "Requesting a status update and compliance assurance regarding the Barwon River incident.", "delivered_at": null, "evaluation_criteria": "Accuracy and speed of response to regulatory inquiry.", "exercise_id": 1, "expected_actions": "Prepare and send a compliance update to the regulatory authority.", "facilitator_notes": "Test the ability to handle regulatory inquiries under pressure.", "id": 4, "image_required": false, "inject_type": "action", "notes": null, "objective_links": [3, 4], "phase_id": 3, "phase_name": "Crisis Communication", "recipient": "Executive Team", "response": null, "sender": "Water Regulatory Authority", "sequence_number": 4, "status": "pending", "team_assignment": ["all"], "time_offset_minutes": 60, "title": "Regulatory Compliance Query", "video_script": null, "video_status": "none", "video_talk_id": null, "video_ticker": null, "video_url": null}, {"branch_condition": "", "channel": "radio", "content": "Local government demands immediate action to prevent further environmental damage amidst public pressure.", "delivered_at": "2026-06-04T11:39:40.729495", "evaluation_criteria": "Ability to prioritize between environmental and operational responses.", "exercise_id": 1, "expected_actions": "Prioritize actions and communicate effectively with local government.", "facilitator_notes": "Introduce conflicting priorities requiring strategic decision-making.", "id": 5, "image_required": false, "inject_type": "decision", "notes": null, "objective_links": [3], "phase_id": 3, "phase_name": "Crisis Communication", "recipient": "Crisis Management Team", "response": null, "sender": "Local Government", "sequence_number": 5, "status": "delivered", "team_assignment": ["all"], "time_offset_minutes": 65, "title": "Competing Priorities", "video_script": null, "video_status": "none", "video_talk_id": null, "video_ticker": null, "video_url": null}, {"branch_condition": null, "channel": "Teams / Slack", "content": "Conflicting reports on equipment repair progress. Some teams report complete repairs, others report ongoing issues.", "delivered_at": "2026-06-04T09:24:05.756127", "evaluation_criteria": "Effectiveness of information clarification and adjustment of recovery plans.", "exercise_id": 1, "expected_actions": "Clarify repair status and update recovery plans accordingly.", "facilitator_notes": "Introduce ambiguity to test information management and decision-making.", "id": 6, "image_required": false, "inject_type": "information", "notes": null, "objective_links": [4], "phase_id": 4, "phase_name": "Recovery and Restoration", "recipient": "Crisis Management Team", "response": null, "sender": "Operations Team", "sequence_number": 6, "status": "delivered", "team_assignment": ["all"], "time_offset_minutes": 85, "title": "Conflicting Reports", "video_script": null, "video_status": "none", "video_talk_id": null, "video_ticker": null, "video_url": null}, {"branch_condition": "", "channel": "News Bulletin", "content": "**BREAKING NEWS SCRIPT \u2013 WASTEWATER INCIDENT**\n\nGood afternoon. We are following a developing story involving a wastewater issue affecting parts of the Barwon Water service area.\n\nBarwon Water has confirmed it is responding to an incident involving a wastewater system fault, with crews currently on site assessing the situation and working to contain the issue.\n\nAt this stage, the cause has not been confirmed. The organisation says public health and environmental protection are its immediate priorities, and it is working closely with relevant authorities.\n\nResidents in the affected area are being asked to avoid contact with any visible wastewater or pooled water and to follow official advice as it becomes available.\n\nBarwon Water is expected to provide a further update shortly as more information is confirmed.\n\nMore to follow.\n", "delivered_at": "2026-06-08T22:43:26.053367", "evaluation_criteria": "Preparedness and consistency of messaging in media interactions.", "exercise_id": 1, "expected_actions": "Prepare a spokesperson and key messages for the interview.", "facilitator_notes": "Test media handling skills and preparedness for interviews.", "id": 7, "image_required": true, "inject_type": "comms", "notes": null, "objective_links": [3, 4], "phase_id": 4, "phase_name": "Recovery and Restoration", "recipient": "Communications Team", "response": null, "sender": "Local News Outlet", "sequence_number": 7, "status": "delivered", "team_assignment": ["all"], "time_offset_minutes": 90, "title": "Media Inquiry", "video_script": "We have breaking news regarding a wastewater incident in the Barwon Water service area. Barwon Water is actively addressing a fault in the wastewater system, with crews on site evaluating and containing the situation. The cause remains unconfirmed, but immediate priorities are public health and environmental safety. Residents in affected areas should avoid contact with any wastewater and follow official updates. Further information from Barwon Water is anticipated soon. Stay tuned as this story develops.", "video_status": "ready", "video_talk_id": "clp_1XFhy4d0D0gFefdInC0EM", "video_ticker": null, "video_url": "https://d-id-clips-prod.s3.us-west-2.amazonaws.com/auth0%7C6a1d0207e4bd08294f2c2620/clp_1XFhy4d0D0gFefdInC0EM/v2_public_Rian_NoHands_RedJacket_Lobby%40eEW_j8_sK6.mp4?X-Amz-Algorithm=AWS4-HMAC-SHA256\u0026X-Amz-Content-Sha256=UNSIGNED-PAYLOAD\u0026X-Amz-Credential=AKIA5CUMPJBIJ7CPKJNP%2F20260604%2Fus-west-2%2Fs3%2Faws4_request\u0026X-Amz-Date=20260604T023613Z\u0026X-Amz-Expires=86400\u0026X-Amz-Signature=161f5b5c32d27fda3aa062798f9db775ab7d2a6f06928dfbc2a9aed78130fffc\u0026X-Amz-SignedHeaders=host\u0026x-amz-checksum-mode=ENABLED\u0026x-id=GetObject"}, {"branch_condition": "", "channel": "radio", "content": "Reports of health issues in the community potentially linked to the wastewater release.", "delivered_at": "2026-06-04T11:01:59.363741", "evaluation_criteria": "Effectiveness of coordination with health authorities and public communication.", "exercise_id": 1, "expected_actions": "Coordinate with health authorities and update public health advisories.", "facilitator_notes": "Introduce health implications to assess crisis management adaptability.", "id": 8, "image_required": false, "inject_type": "escalation", "notes": null, "objective_links": [3, 4], "phase_id": 4, "phase_name": "Recovery and Restoration", "recipient": "Crisis Management Team", "response": null, "sender": "Local Health Department", "sequence_number": 8, "status": "delivered", "team_assignment": ["all"], "time_offset_minutes": 95, "title": "Community Health Concerns", "video_script": null, "video_status": "none", "video_talk_id": null, "video_ticker": null, "video_url": null}, {"branch_condition": null, "channel": "Email", "content": "Update: Replacement parts for the malfunctioning equipment will arrive in 48 hours.", "delivered_at": "2026-06-09T23:56:23.662555", "evaluation_criteria": "Timeliness and accuracy of recovery plan updates.", "exercise_id": 1, "expected_actions": "Update recovery plans based on new equipment arrival timeline.", "facilitator_notes": "Test supply chain management and adjustment of recovery timelines.", "id": 9, "image_required": false, "inject_type": "action", "notes": null, "objective_links": [4], "phase_id": 4, "phase_name": "Recovery and Restoration", "recipient": "Operations Team", "response": null, "sender": "Equipment Supplier", "sequence_number": 9, "status": "delivered", "team_assignment": ["all"], "time_offset_minutes": 100, "title": "Equipment Supplier Update", "video_script": null, "video_status": "none", "video_talk_id": null, "video_ticker": null, "video_url": null}, {"branch_condition": null, "channel": "Email", "content": "Please prepare for a post-incident review meeting to discuss lessons learned and improvements.", "delivered_at": null, "evaluation_criteria": "Participation and quality of feedback in the review process.", "exercise_id": 1, "expected_actions": "Prepare for and participate in the post-incident review.", "facilitator_notes": "Set the stage for after-action review and continuous improvement.", "id": 10, "image_required": false, "inject_type": "action", "notes": null, "objective_links": [4], "phase_id": 4, "phase_name": "Recovery and Restoration", "recipient": "All Participants", "response": null, "sender": "Crisis Management Team Leader", "sequence_number": 10, "status": "pending", "team_assignment": ["all"], "time_offset_minutes": 105, "title": "Post-Incident Review Announcement", "video_script": null, "video_status": "none", "video_talk_id": null, "video_ticker": null, "video_url": null}, {"branch_condition": "", "channel": "dark_web", "content": "Barwon Water is contacted by hackers with a ransom ultimatum. They have used the disruption as the mechanism to attack and have stolen some data. Will they pay the $500,000 asked?", "delivered_at": null, "evaluation_criteria": "", "exercise_id": 1, "expected_actions": "", "facilitator_notes": "", "id": 11, "image_required": true, "inject_type": "information", "notes": null, "objective_links": [], "phase_id": null, "phase_name": "", "recipient": "", "response": null, "sender": "", "sequence_number": 11, "status": "pending", "team_assignment": ["all"], "time_offset_minutes": 0, "title": "Ransom Ultimatum", "video_script": null, "video_status": "none", "video_talk_id": null, "video_ticker": null, "video_url": null}, {"branch_condition": "", "channel": "News Bulletin", "content": "The chief wardens and clinical health coordinators need to manage a flood basement of a major regional hospital.", "delivered_at": "2026-06-09T23:56:12.665164", "evaluation_criteria": "", "exercise_id": 1, "expected_actions": "Assess the risk, review business continuity strategies, identify impacted services, contact stakeholders.", "facilitator_notes": "", "id": 100, "image_required": true, "inject_type": "information", "notes": null, "objective_links": [], "phase_id": null, "phase_name": "", "recipient": "", "response": null, "sender": "", "sequence_number": 12, "status": "delivered", "team_assignment": ["all"], "time_offset_minutes": 0, "title": "Basement of Hospital Flooded", "video_script": "A major regional hospital is grappling with a basement flood. The hospital\u0027s chief wardens and clinical health coordinators are on the scene, working to manage the situation. The flood has affected vital equipment and storage areas. Despite the disruption, hospital officials assure that patient care remains unaffected. Emergency protocols are in place, with teams prioritizing the relocation of essential supplies. The cause of the flood is currently under investigation. Authorities urge visitors to avoid the area until further notice. Live from the newsroom, I\u0027m BC Studio Correspondent, BC Studio News.", "video_status": "processing", "video_talk_id": "clp_eqbXiVLjnYWiW-onFBV5d", "video_ticker": null, "video_url": null}], "is_multi_team": false, "knowns_at_start": "- The primary wastewater pump system has failed.\n- Untreated wastewater is being discharged into the Barwon River.\n- There\u0027s ongoing heavy rainfall increasing the risk of further overflow.", "num_phases": 4, "objectives": [], "objectives_data": [{"capability_area": "Incident Escalation", "evaluation_method": "checklist", "exercise_id": 1, "id": 64, "objective_text": "Test the effectiveness of the Crisis Management Team\u0027s (CMT) initial response to the wastewater management failure.", "sequence_number": 1, "success_criteria": "CMT convenes within 30 minutes of incident notification and establishes an initial action plan."}, {"capability_area": "Crisis Communications", "evaluation_method": "checklist", "exercise_id": 1, "id": 65, "objective_text": "Validate the timeliness and accuracy of internal and external communications during the incident.", "sequence_number": 2, "success_criteria": "All communications are approved within 15 minutes and align with the golden rules of crisis communications."}, {"capability_area": "Decision-Making", "evaluation_method": "checklist", "exercise_id": 1, "id": 66, "objective_text": "Assess the decision-making process regarding the invocation of Business Continuity Plans (BCPs).", "sequence_number": 3, "success_criteria": "BCPs are invoked within the established RTO of 2 hours for critical services."}, {"capability_area": "Regulatory And Legal", "evaluation_method": "checklist", "exercise_id": 1, "id": 67, "objective_text": "Evaluate the ability to comply with regulatory notification requirements during the incident.", "sequence_number": 4, "success_criteria": "Regulatory bodies are notified within the required timeframes: FCA/PRA within 4 hours, ICO within 72 hours if applicable."}, {"capability_area": "Recovery And Lessons", "evaluation_method": "checklist", "exercise_id": 1, "id": 68, "objective_text": "Confirm the adequacy of recovery strategies for restoring wastewater management operations.", "sequence_number": 5, "success_criteria": "Recovery strategies are initiated within the MTPD and achieve the MBCO for wastewater services."}], "organisation": null, "participants": ["Executive / Crisis Management Team", "Communications / PR", "Business Continuity"], "phases_data": [{"end_offset_minutes": 20, "exercise_id": 1, "focus": "Testing the initial response and notification procedures.", "id": 1, "name": "Initial Failure Detection", "phase_number": 1, "start_offset_minutes": 0}, {"end_offset_minutes": 50, "exercise_id": 1, "focus": "Evaluating escalation protocols and initial assessment of impacts on operations and stakeholders.", "id": 2, "name": "Escalation and Impact Assessment", "phase_number": 2, "start_offset_minutes": 20}, {"end_offset_minutes": 80, "exercise_id": 1, "focus": "Assessing internal and external communication strategies, including media handling and stakeholder updates.", "id": 3, "name": "Crisis Communication", "phase_number": 3, "start_offset_minutes": 50}, {"end_offset_minutes": 100, "exercise_id": 1, "focus": "Testing continuity plans and restoration of normal operations.", "id": 4, "name": "Recovery and Restoration", "phase_number": 4, "start_offset_minutes": 80}], "plans_to_test": [], "risk_alignment": null, "scenario_assumptions": "- All communications systems are operational.\n- The crisis management team is immediately available.\n- Local authorities are aware of the incident but have not yet intervened.", "scenario_category": "", "scenario_name": "Wastewater Management Failure with third party dependencies", "scenario_narrative": "Barwon Water is facing a critical malfunction in its wastewater management system at the Geelong treatment plant. A sudden and severe failure in critical third-party managed equipment has led to untreated wastewater being released into the Barwon River. The incident occurs during a period of heavy rainfall, exacerbating potential overflow and environmental impact. The failure not only threatens the integrity of water quality but also poses significant challenges in maintaining service continuity to the affected regions. As the organization scrambles to manage the immediate fault, they must also deal with the potential regulatory breaches and community concerns over environmental and health implications. This scenario tests Barwon Water\u0027s resilience and ability to coordinate an effective response amidst escalating operational, regulatory, and reputational challenges.", "scheduled_date": null, "scope_in": null, "scope_out": null, "status": "in_progress", "teams": ["alpha", "bravo", "charlie"], "title": "Wastewater Management Failure", "trigger_event": "An unexpected failure in the primary wastewater pump system, managed by a third-party contractor, leads to untreated waste entering the Barwon River during peak rainfall.", "unknowns_at_start": "- The exact cause of the pump failure.\n- The full extent of environmental impact.\n- Whether the third-party contractor has a contingency plan in place.\n- The timeline for repair and recovery of the system."}