Start a conversation ↗

Description

Cyber Crisis Management: Building the Crisis Unit, Simulating the Attack and Deciding Fast

Organise the crisis unit and decide under pressure when the information system is down

  • 1 day — 7 h
  • In-person or virtual
  • Intermediate
  • Up to 6 participants

A ransomware attack is never only a technical matter. Within the first few hours you must decide whether or not to isolate systems, set the recovery sequence, inform customers and the relevant authorities, and make teams work together that rarely interact. Plans usually exist, but they have never been tested.

This one-day programme alternates methodological input with a simulation exercise. Participants build a crisis unit, handle an attack that unfolds during the session, take decisions under time pressure and manage both internal and external communication. The debriefing produces the corrections each participant needs to make to their own arrangements.

Learning objectives

  • Structure a cyber crisis unit and allocate decision-making roles
  • Qualify the incident and define the first containment measures
  • Balance business continuity against the preservation of technical evidence
  • Organise internal and external communication during the crisis
  • Manage the return to normal operations and the lessons-learned review

What makes this programme different

The day is built around a simulation that unfolds in real time
Every decision taken is confronted with its consequences within the exercise
The debriefing produces a list of corrections to apply to each participant's own arrangements

Programme

1Building the Crisis Unit

Knowing who decides and through which chain

  • Composition of the decision-making and operational units
  • Activation criteria and escalation levels
  • Roles, responsibilities and the alert chain
  • Working arrangements in degraded mode
  • Interface with service providers and insurers

2Simulating a Cyber Attack

Deciding under time pressure

  • Incident qualification and first containment measures
  • Choosing between system isolation and business continuity
  • Preserving technical evidence needed for investigations
  • Managing internal and external stakeholders
  • Regulatory notifications and disclosures to anticipate

3Communication and Crisis Exit

Holding the line and closing the incident

  • Messages for employees, customers and partners
  • How to handle media enquiries
  • Return-to-normal criteria and recovery sequence
  • Lessons-learned review and remediation plan

Who is it for

Information security officers · IT directors · business continuity managers · executives and communication managers.

Prerequisites

A working knowledge of information systems security.

Dates & locations

36 scheduled dates between November 2026 and December 2027. Seats are confirmed in the order enquiries are received.

November 2026

December 2026

January 2027

February 2027

March 2027

April 2027

May 2027

June 2027

September 2027

October 2027

November 2027

December 2027

None of these dates suit you? We open additional sessions on request, and any programme can be run privately for your team.

Practical details

Before the programme
Online positioning questionnaire. Your development objectives are shared with the trainer, who tailors the practical case studies to your context.
Teaching methods
Theoretical input, workshops and practical case studies. Digital course materials and method sheets provided.
Assessment
Multiple-choice tests and role-play exercises. Assessment of learning at the start and end of the programme, with immediate and 60-day follow-up evaluations.
After the programme
One year of access to the e-learning platform. Self-assessment of the skills acquired and a 30-day follow-up session with your trainer.
How to register
Registration online or on the basis of a quotation.
Lead time
11 working days after confirmation of registration.
Accessibility
Accessible to people of determination. Contact our accessibility coordinator to design a suitable solution: contact@mpf-academy.ae
Start dates
Rolling intake: in addition to the scheduled sessions, this programme can start on request.