Service · facilitated, half a day
Find out what your people do before it matters
A simulation walks the people who would actually handle an incident through a scenario built for your business, hour by hour, and records where the plan broke. Nothing goes near your live systems. This tests decisions, not firewalls: who declares the incident, who calls the customers, when the notification obligations start, and what happens when the leak came from an AI system nobody had listed.
Who this is for
Organisations that have an incident-response plan and have never run it, and organisations that do not have one and suspect that matters. It suits the operational layer — the people who would be on the call at 7am — rather than the board, which has its own session.
Insurers increasingly ask at renewal whether the plan has been exercised in the last twelve months. A dated record from this exercise answers that question. Federally regulated firms use it to evidence the operational-resilience testing OSFI expects.
The Canadian clock is not the one people expect
There is no 72-hour rule here. That is the European and British standard, and a good deal of imported material repeats it as though it applied in Canada. It does not. PIPEDA requires a report to the Privacy Commissioner "as soon as feasible" after determining a breach poses a real risk of significant harm. Quebec's Law 25 requires notification "with diligence". Alberta requires it "without unreasonable delay".
That is harder than a deadline, not easier. A fixed clock tells you when you are late. A standard of promptness means the question becomes what a reasonable organisation would have done, judged afterwards, by someone with the whole file. The organisations that come out of that well are the ones that can show when they knew, who decided, and why the timing was what it was.
Which is exactly what this exercise produces. Every decision is logged with the time and the person who made it. That log is the thing you would want to have.
What we actually do
A scenario built for your business, not a generic deck.
- One call with your IT or operations lead to learn your systems, suppliers and customers
- A scenario chosen from ransomware, supplier breach, AI data exposure, payment-diversion fraud, or one you propose
- Complications timed to your real dependencies: the payroll run, the month-end, the shipment
Three hours working the incident in stages, with the facilitator adding pressure as it unfolds.
- Who declares, who leads, who is told, and in what order
- The moment the organisation determined a breach had occurred — and whether anybody noticed, because that is where the record starts
- Whether Quebec staff or customers put the CAI in the picture alongside the federal Commissioner, and who works that out
- What you say to customers, staff, the press and your insurer, and who is allowed to say it
- Every decision logged with the time and the person who made it
The written record, and the list of what to fix.
- A findings report: where the plan, the delegations and the contact lists broke
- The decision log, in the form insurers ask for at renewal
- A prioritised fix list with a suggested owner for each item
- A dated confirmation letter for questionnaires and renewals
Why not run it yourselves?
You can, and you should. Our tabletop exercise packs exist for exactly that — card decks, a facilitator's guide, complications and a decision log — and the ransomware scenario is free.
The facilitated version is for when you want an outsider running it: because the people who wrote the plan cannot see its gaps, because the exercise needs to be recorded by someone with no stake in how it went, or because the board has asked for evidence that it happened and would rather that evidence did not come from the IT manager.
What this looks like in practice
The regional ISP that rehearsed an extortion with no encryption
A regional internet and telecoms provider in Atlantic Canada, after Bill C-8 received Royal Assent in June 2026.
Why it mattered now. The incident plan assumed classic ransomware: systems down, restore from backup. The Canadian Centre for Cyber Security reports a shift to exfiltration-only extortion, where nothing is encrypted and stolen data is simply threatened with publication. With Bill C-8 now law, telecoms providers face new government security powers.
What we found.
- The plan’s first step was “isolate affected systems”. Nothing was affected, so for 40 minutes nobody owned the incident.
- No one could say which regulators, customers or partners had to be told, or by when.
- Outbound traffic logs were kept for seven days, so nobody could confirm what data had left.
What the board received. A written record of each decision point, suggested minutes wording, and six fixes in priority order, including a pre-agreed board position on extortion.
“We had rehearsed losing our systems. We had never rehearsed keeping them and losing our customers’ trust.”
This is an illustrative composite based on typical engagements, not a named client. Source: Canadian Centre for Cyber Security, Ransomware Threat Outlook 2025–2027.
What it costs
One scenario, one half-day, up to fifteen participants, at your offices or online, with the written record.
From CAD $5,000
Plus applicable taxes. Multi-site organisations, a full-day exercise with two scenarios, or an exercise that includes your key suppliers are priced on scope. Travel beyond the Greater Toronto Area is charged at cost and agreed beforehand.
The same scenarios in pack form, with everything you need to run them internally.
Free
The ransomware scenario is free; all three are CAD $145. Many organisations run the free pack first and book the facilitated version once they have seen what it turns up.
What actually happens, and when
First conversation
No charge. We establish who would be in the room, whether a plan exists, and what the organisation most needs to learn. If you would be better served by the free pack, we say so.
Within a week
A scoping letter with the fixed fee, the date and the proposed scenario. Participants receive a one-page pre-read and nothing else — the point is to see what they do, not what they revised.
Your effort
One hour with your IT or operations lead before the day. Participants give up half a day. Nobody prepares a presentation.
The exercise
Three hours with a break, in stages, with complications added as you go. Nothing is scored against individuals and nothing is filmed.
Within five working days
The findings report, decision log and fix list, plus a thirty-minute call to walk through them with whoever owns the plan.
Afterwards
The findings are yours. We do not rewrite your plan, because we would then be assessing our own work. We will tell you exactly what it needs to say.
There is no charge for the first conversation and no obligation at the end of it. If you have never written an incident plan, start with The first hour, which is free.