Platform role required: Crisis Sim Manager

There may be circumstances where organizations want to create bespoke scenarios that are directly relevant to organizational needs and/or policies.

The Immersive Crisis Simulations solution includes a content-builder tool, which enables the creation of custom scenarios.

To perform these actions, a Crisis Sim Manager platform role must be assigned. To learn more on platform roles and permissions, see our Roles and Permissions guide.

This guide includes the following sections:

Best practice in exercise design
Injects, inject options, option feedback, paths/branches and performance indicators
How to create a custom Crisis Simulation scenario
FAQs
- I've created a custom scenario, but I can't find it in the scenario catalog when scheduling an exercise
- I've created and published my custom scenario...Now what?

Best practice in exercise design

Consider:

Which crisis scenario will the exercise be based on?

Are there any high-risk areas or particular threats your organization is currently facing? What will resonate with your target audience?

What is plausible?

Threat examples: risk of disruption to critical infrastructure or supply chain; a ransomware attack; theft of intellectual property; customer data being maliciously leaked.

What are the learning objectives?

Would you like to test your employees' familiarity with company regulations?

Are there any key cyber capabilities you wish to exercise?

Are there key teams you want to target? E.g., your crisis management team?

Are you looking to measure confidence against responses?

What resources will you require to gather to enable your content design?

Consider organizational policies, such as incident response plans. These can be embedded into the scenario, making it specific to your organization.

What are the key events that will occur in the scenario? What order do they occur in?

The timeline of key events will then be the scenarios' foundation.

Are there any existing crisis simulation scenarios that can be utilized?

We recommend browsing the Crisis Simulation Scenario catalog, as there may be existing scenarios scenarios to draw inspiration from.

When creating a custom scenario, make a choice between creating a new scenario from scratch, or create a scenario from a template. Copying a scenario from a template will take a copy of the entire scenario (including scenario events, injects, as well as media). These elements can then be amended.

Browsing the catalog beforehand enables organizations to understand the scope of work for creating a bespoke scenario.

Injects, inject options, option feedback and performance indicators

Injects

We call every decision point in our scenarios an inject. Scenarios are made up of injects.

We recommend including between 8-12, which should take participants about an hour to complete.

Injects should be succinct and include key information.

Each inject can include supporting attachments, such as images, videos, audio, and URLs. Including these elements is important, as they'll bring the scenario to life.

Examples of media to attach:

A video from an executive member of staff
An email from a member of staff affected by the crisis
An email of a customer complaint
A news article about your organization / the crisis

Inject options

Participants must choose one of the options in the inject.

These can be ranked: weak; okay; good; or great.

One path within your scenario must have a 'great' option ranking in each inject.

It's possible that only one path within a given scenario will have all its injects having great options. E.g., A scenario can be written in a way where selecting a 'weak' answer takes users down a path where the best inject options are only ranked as 'okay'.

When writing inject options, we recommend starting with the best choice, followed by the least preferred choice, then filling in the gaps with the in-between choices.

Note: in some cases, the crisis at-hand will mean that there is no real "great" choice.

In the example below, none of the options are ideal; they all have compromises.

However, the least-worst option should still be ranked as 'great' in the inject ranking options, since this is the strongest answer.

Inject option feedback

What is this?

This feedback is what a participant sees after selecting a particular option in an inject within a scenario.

This space should include the reasons why options were ranked in that way.

Feedback helps learners understand the quality of their response. If they selected a weak option, the feedback should help them learn and make a better choice in the future.

Both option rankings and feedback should be mapped back to your organization's best practice or industry frameworks. E.g., Option A is a weak answer because ISO27001 says this should never be done.

What should I include?

A recap of the inject / a summary of the decision they were asked to make
The rationale around the weakest option
The rationale around the middle option(s)
The rationale around the strongest option

Paths/Branches

In a custom scenario, choosing particular options might lead down a particular pathway. For example, in the screenshot above, paying a ransom will have very different consequences to not paying the ransom. Therefore, selecting each option might take you down a very different branch in the scenario.

Our tree view mode provides a view of all your scenarios pathways.

Use this mode when reviewing the scenario, or in the initial planning stages.

Performance indicators

Performance indicators show the immediate impact of a learner's decision on one or more key business metrics.

They are dynamic graphs which change throughout the exercise (based on the learner's decisions at various injects) and provide a visual representation of the real-world implications these decisions have.

Performance Indicators are completely optional; if they don't add value to a scenario, don't use them.

Here are a few examples of potential performance indicators:

Company reputation
Return to operations
Share price

All indicators should have a starting value reflecting the situation at the start of the scenario. This value would either increase or decrease based on the inject options selected.

Some inject options (a 'great' or a 'good' decision, for example) would positively affect scoring of the performance indicator.

Other inject options (such as a 'weak' decision) would negatively affect its scoring. An 'okay' decision may have no impact on a performance indicator's value.

How to create a Crisis Simulation scenario

Follow the steps below:

1. Navigate to Exercise in the main navigation men and select Immersive Crisis Simulations.

2. Select the Create Scenario button on the right:

3. To create a new scenario using the AI Crisis Sim generator, select Create with AI. Please refer to the Create an AI Scenario article in this guide.

To create a new scenario by using an existing one, select Create from template.

To create your own scenario from a blank canvas, select Build new scenario.

To create a new custom scenario by importing an Excel sheet, select Import your scenario. Please refer to the Creating a New Custom Scenario via Excel Download/Import article in this guide.

4. The Overview section of your new custom scenario enables you to fill in the relevant scenario details. Some have pre-populated options. Select 'Other' if none apply.

Scenario Title (e.g., Sample Manufacturing Ransomware Scenario)
Authoring Language - the authoring language is required for translation purposes. Translations are only supported for the languages listed in the drop-down list.
Industry sector (e.g., Manufacturing)
Attack vector (e.g., Ransomware)
Threat actor (e.g., Criminal Groups)
Briefing – This should set the scene and describe the crisis that your organization is faced with. We recommend writing this in a text editor before copying and pasting over to ensure that there aren't any typos or grammatical errors. A WYSIWYG rich-text editor to allow you to easily format the briefing.

5. Decide on roles.

Who is the user impersonating in the scenario?
Select a category for the role from the dropdown and give the role a title (usually job title).
Add some context around the role by considering some of their responsibilities, and who they manage and/or report to. This can be completed in the Responsibilities area.
Scenarios can have a single role or include multiple roles.
If opting for one single role, this role would have to be present in all injects in the given scenario.
If including multiple roles, scroll down and select the 'Add another Role' button. Replicate this process for each new role.

Note: If more than one role is created, assign these roles to injects at the inject creation stage.

6. Option Feedback: Choose whether to provide feedback in injects and at what stage (during their selection or at the end of the exercise with the results):

7. Choose whether to rank the options.

We recommend ranking options, as it allows participants to understand the strength of their answer and implications in the real world.
Enabling ranking also results in further granularity in reports. Our After Action Reports (AARs) provide metrics based on participants' rankings.
Read more about option rankings here.

8. The next step is the Analysis section.

Choose whether the options you present participants with require justification and a confidence score:

We recommend adding a confidence score, as it provides a further layer of granularity around decisions that are made.
Metrics and analysis around confidence are also included in our AARs, which become available after a Crisis Sim exercise is completed.
Justification refers to asking the participant to respond to why they chose a certain option, in the form of free text.

9. Choose to include performance indicators to reflect participants' choices.

10. Once the navigation settings above are complete, start creating injects.

NOTE: Injects are key decision points in the scenario that you want the user to face. Each inject needs a detailed description that unfolds the story a little more and asks the user what they’d do next. The description should provide enough context for the user to pick an answer. This can be supplemented with media attachments.

The below process will need to be repeated, for each inject created. To add the first inject, select the 'Add Inject' button:

Give the inject:

A title
A time and a date – this should be realistic and laid out in a logical manner, based on injects coming before and after.
A description – keep this concise: one or two sentences are typically enough.
A role assignment – if your scenario only has a singular role, this will be assigned here by default. If you've created multiple roles, you'll need to choose which role to assign to the inject
Media attachments (e.g., simulated tweets, news articles, or broadcasts).
NOTE that the maximum file size for attachments is 100 MB. Supported file types are MP3, WAV, PNG, JPG, MP4, M4A and PDF.

11. Complete inject options. We suggest between 3-5 options per inject.

Each inject will offer a list of options for the user to choose from to determine what happens next in the scenario. Each response needs a title, a short description, and some feedback, detailing to the user why their response was a good choice or not. If a response isn’t chosen at first, it can be repurposed again later in a different inject. Give each option:

A title
A description
Feedback
A ranking
An impact of how it will affect indicators
An 'option logic' – this is a selection of which inject you'll be taken to after you've selected a given option. This process enables you to build your scenario branches/pathways. Create a new inject from here, or select a pre-populated inject.

12. Complete all injects and inject options by repeating the step above.

13. Test the flow of the scenario in preview mode.

NOTE: You can click the Preview Inject option to preview each inject as you create or edit them. This is an effective way of creating and editing injects, as it does not require you to run through the full scenario to test a single inject:

Access preview mode by selecting the 'Preview' button in the top right at any point during the content creation process. Previewing the scenario allows you to test different options to ensure the result is as expected. Navigate backwards and forwards within the scenario and then return to create mode to continue creating or editing.

14. Write the epilogue.

This is a concluding paragraph that summarizes the scenario. This section can include:

The main impacts of the decisions made
What the key learning objectives are

15. Translate the Scenario

You can translate your scenario into all of the supported platform languages English, German, French, Spanish, Portuguese, Italian, Japanese). When a user changes their language preference, they will see the scenario translated into that language.

To translate the scenario:

From the top navigation menu, select the third step, 3. Translate:
Select Yes for auto-translation.
Click Translate.

16. Publish the scenario.

View the summary for an overview of the scenario and then hit publish via the button located in the top right-hand corner.

FAQs

I've created a custom scenario, but I can't find it in the scenario catalog when scheduling an exercise

The new scenario won't be listed when scheduling an exercise if it was not published when you created it. In this case, the scenario is in a draft state, and won't appear in the scenario catalog.

To publish the scenario, select the 'Create Scenario' button on the top right.

Below the two 'Create' options, you'll find a list of your 'Draft Scenarios'.

Search for the scenario and select 'Edit'.
Select the 'Review' button on the top right, and then 'Publish'.

You'll now be able to schedule an exercise with this scenario.

I've created and published my custom scenario...Now what?

If you want your teams or individuals to start consuming the created content, you'll need to set up an exercise. You can then assign these to individuals or teams.

Think of the scenario as the template – an exercise is the iteration of the template that you can assign to participants and set a deadline for.

For more information on scheduling exercises, including the different exercise types, see:

Schedule an Exercise

Before Scheduling an Exercise: Considerations