Incident response exercises as a capability and talent agent - Excuse me? What, it's really not just an IT thing?

This session is about what is traditionally seen as technical drills and how they can be powerful levers for developing people and leaders.

1. Why incident response exercises matter.

Exercises help us test our assumptions, expose the dependencies between functions and departments and test ourselves under pressure for when we experience the inevitable cyber attack. From a people perspective they reveal how your team members or organisation behaves when the heat is on.

2. A hidden ROI. Talent development.

These exercises surface high potential talent. These are the people who remain calm, think strategically, or step up to lead even when they don’t have the title in their name. Exercises also help to build skills like decision making, collaboration and communication which are all essential traits in our incident managers, technical responders and our execs when dealing with a crisis.

3. A shared capability framework.

When running exercises look at the organisational readiness. For example, did the playbooks work, did teams and individuals know what their role and responsibility was, did our security controls work when pushed to the limits. At the same time watch for behavioural insights. For example, who took initiative, where did the silos appear if there were any, which communication styles helped and which didn’t?

4. A case study (hypothetical).

Something something happened, it stress tested our something system/business processes. Of note were unclear handovers, unclear decision tree, lack of access to leaders, and some individuals who showed great aptitude for adaption and decisiveness. These observations can be used to align capability progression with actual behaviours.

5. Designing exercises for dual outcomes.

If you want dual value, that is resilience and talent development, you need to design exercises with both lenses on. That includes in the brief, what roles to include, and in the debrief. The debrief can help us know not just if the plan worked but how people worked together. HR can then use those insights.

6. Incident response playbooks.

IT has planning templates, technical checklists and process to track improvements. HR can use these in things like learning and development plans, leadership coaching and team development.

7. Success factors.

Exercises don’t just reveal gaps, they reveal potential. These can be woven into performance conversations, development, and succession planning. Meanwhile cyber learnings will feed into controls and process as well as a whole of org cyber practise and resilient culture.

8. How to get started.

You don’t need a novel of documentation or manual. If you are already running tech exercises ask HR to participate in the next brief, add a role in your exercise for a talent observer. If you are not running start with a small 1 hr exercise, leverage a real incident, such as an unplanned outage, and bring in HR to debrief together.

9. Conclusion leading to Q&A.

When we see exercises as a shared opportunity for both IT defenders and people development we build real organisational resilience.