Cyber resilience: preparation is more than half the battle

Organisations need to understand their critical processes, essential systems, supply chain dependencies and crisis governance structures before an incident occurs. If these questions are only addressed during a crisis, it is often already too late.

Cybersecurity becomes a board responsibility

Regulations such as NIS2 and DORA are bringing cybersecurity firmly into the boardroom. For organisations within the scope of these regulations, executive management is expected to play a central role in overseeing cyber risk.

Regulators no longer focus solely on technical security measures. They increasingly expect organisations to demonstrate that board members understand cyber risks, supplier dependencies, business process impacts and their own responsibilities during a crisis.

Ultimately, it comes down to one simple question: do you know what to do if a large-scale cyber crisis strikes tomorrow?

A theoretical question? Unfortunately not. Recent cyber incidents affecting Albert Heijn and, during the same week, a French supermarket chain demonstrate that cyber threats are neither theoretical nor limited by national borders. They are everywhere and can impact any organisation.

The power of gamification: learning through experience

While gamification was once viewed primarily as an innovation experiment, it has now proven itself in a growing number of successful real-world applications. By actively engaging participants, organisations create greater ownership, stronger involvement and a lasting learning effect. Gamification has become a powerful way to connect knowledge, awareness and decision-making.

A board-level cyber game brings together executives, board members and key stakeholders in a realistic cyber crisis simulation. The objective is not to test systems, but to rehearse and stress test human behaviour and decision-making under pressure. Participants face dilemmas involving crisis management, communications, legal obligations, business continuity and reputation management.

"You've just been hacked"

This is the message that launches the Forvis Mazars Cyber Game. Prior to the session, a customised scenario is developed based on the organisation's specific risks, industry, business processes and dependencies. This creates a realistic and highly relevant crisis situation.

During the game, executives, management and key personnel are confronted with a rapidly evolving cyber incident. Under significant time pressure, they must make decisions regarding crisis management, communication with customers and regulators, operational continuity and recovery actions. The interactive simulation reveals not only whether procedures exist, but more importantly how people actually collaborate and respond when pressure reaches its peak.

Following the exercise, a structured debrief is conducted to discuss observations, strengths and areas for improvement. These findings are documented in a report containing practical recommendations to further enhance cyber resilience, crisis response capabilities and decision-making processes. As a result, the Cyber Game serves not only as an awareness-building tool but also as a practical step toward greater cyber resilience maturity.

Cybersecurity Awareness Month as a starting point

Leading organisations no longer view cyber resilience as a purely technical challenge, but as a strategic business issue. Cybersecurity Awareness Month provides an excellent opportunity to initiate this broader discussion. Not only about phishing emails and strong passwords, but more importantly about how prepared the organisation truly is for a significant disruption.

Some questions board members and executives should ask themselves include:

• Do we have sufficient insight into our critical business processes?
• Do we maintain an up-to-date Business Continuity Management (BCM) programme?
• Are board members adequately prepared for their role during a cyber crisis?
• When was the last time the executive team or management team participated in a realistic crisis simulation?
• Do we know how our organisation would respond if the words "You've just been hacked" became reality?

Organisations that are able to answer these questions affirmatively today are the organisations most likely to demonstrate resilience tomorrow. Ultimately, success in cybersecurity is not defined solely by preventing every incident, but by the ability to continue operating when an incident occurs.

Would you like to understand how your board or management team would respond during a cyber crisis? A realistic cyber game can provide valuable insights and practical recommendations for improvement.