Facilitator Pack — Multi-Vector Cyber-Kinetic Crisis

Before you start

• Assign roles: one facilitator, one scribe, the rest as the Aegis leadership team.
• State the ground rules: decisions are made out loud; the clock is final; the review is blame-free.
• Read the standing context (Slide 3): backups restore-tested "a while ago," a crisis team on paper, principals travelling, a Friday afternoon.

Inject 1 — The urgent call (90s) · tests Lesson 09

A cloned-voice "CEO" demands an urgent payment and cannot take a callback. Decision forced: act on the channel or verify independently. Strong play: refuse to act on the call; verify via an independent number + pre-agreed code word; default to "no" if unverified.

Inject 2 — Something's inside (120s) · tests Lessons 06, 13

Odd access on a sensitive system plus large downloads by a passed-over staffer. Decision forced: act on the person, or take reversible protective steps while verifying. Strong play: restrict/monitor the access proportionately; separate evidence from inference; avoid public accusation.

Inject 3 — The lock-out (180s, peak) · tests Lesson 12

Mass encryption plus a double-extortion demand; backups untested. Decision forced: improvise a pay/no-pay call, or apply pre-decided policy. Strong play: direct not do; contain vs preserve; treat pay/no-pay as policy driven by backups and legal/sanctions position, not the ransom amount.

Inject 4 — Complication abroad (120s) · tests Lessons 07, 08, 09

A travelling principal's laptop was out of sight in a higher-risk jurisdiction; the secure channel is unreachable. Decision forced: treat the device as suspect and find an alternate channel. Strong play: assume compromise, quarantine/rotate, invoke a PACE fallback, and weigh personal safety.

Inject 5 — The story breaks (300s) · tests Lessons 02, 13

A journalist has the leaked data and a source naming a state; the board wants a statement within the hour; attribution is unconfirmed. Decision forced: attribute publicly, stay silent, or communicate calibrated uncertainty. Strong play: avoid the one-way door of naming a state; state what is known, unknown, and being done.

Keep it honest

• Enforce every timer; do not allow "we'll wait for more information" past the clock.
• Inject cross-pressure: the board, the press, and travelling staff all want answers at once.
• Note when a strong play depended on a decision that should have been made before today — that is the finding.

Structured debrief (10–15 min)

• What went well? Which prior decisions saved time?
• What hurt? Where did a missing plan cost you?
• What surprised you? Which assumption proved false?
• What changes on Monday? Capture three actions with named owners and dates.