Practice Makes Readyrehearse the first hour of a security incident

17 scenarios, written not generated.

148 timed updates in total, each one written by hand and reviewed. Every legal deadline names the law it comes from, and anything a scenario makes up for the sake of the exercise says so on the page. Pick the one that matches how your organization actually holds money, data and its own public voice.

Scenarios
17
Timed updates
148
Shortest / longest
15 / 60 min

Narrow it down

17 of 17 scenarios

How long you have

Run this if…

What it leans on hardest

Two of the scenarios carry no conditions — they apply to any organization, so they stay in the list whichever of the “run this if” filters you pick. Phase and lane coverage are not filters: almost every scenario touches all five of each, so filtering on them would hide nothing.

Fifteen minutes

3 scenarios

One decision under pressure, no build-up, no preparation. Short enough to run at the start of a meeting that was happening anyway — which is how most organizations do this for the first time.

  1. Authority and escalation

    01 / 3

    It is 2am and someone has to say yes

    Fifteen minutes on one question: who can authorize taking systems offline when the office is closed and the person you would normally ask is not answering.

    • Run this if you have never agreed who decides things outside office hours
    Shape
    15 min · 3 updates
    In the room
    3 in the room
    Leans on
    Decide

  2. Reporting and human factors

    02 / 3

    Someone clicked, and waited a day to say so

    Fifteen minutes on one question: how quickly does a member of staff who made a mistake tell somebody, and what does this organization do that makes waiting the safer choice.

    • Run this if you are not sure staff would tell you quickly if they clicked something
    Shape
    15 min · 3 updates
    In the room
    3 in the room
    Leans on
    Communicate

  3. Payment fraud

    03 / 3

    The bank details changed by email

    Fifteen minutes on one question: what has to happen before this organization pays money to a bank account it has not paid before.

    • Run this if money leaves on instructions that arrive by email
    Shape
    15 min · 3 updates
    In the room
    3 in the room
    Leans on
    Decide

A full hour

14 scenarios

The complete exercise: updates arriving on a clock, a debrief while the room is still together, and an After-Action Report with owners and dates. Every one of them puts the room through at least four of the five response phases and at least three kinds of work — a floor enforced by an automatic check, not left to whoever wrote the scenario.

  1. Ransomware

    01 / 14

    The shared drive is gone

    A Monday morning starts with nobody able to open a file. By the end of the hour the room has to decide who can authorize pulling systems offline, what it tells staff, and whether beneficiary data is in scope.

    • Run this if you keep shared files anyone in the office can open
    • Run this if you have never restored a backup to check it works
    • Carries a legal deadline
    Shape
    60 min · 10 updates
    In the room
    6 in the room
    Leans on
    Decide

  2. Business email compromise / payment fraud

    02 / 14

    The bank details changed

    A supplier payment has already gone to the wrong account, and the email that asked for it came from a real address. The room has to move money, mailboxes and a donor relationship at the same time.

    • Run this if you pay suppliers or partners on emailed invoices
    • Run this if more than one person can release a payment
    • Carries a legal deadline
    Shape
    60 min · 9 updates
    In the room
    6 in the room
    Leans on
    Decide

  3. Device seizure or loss with beneficiary data

    03 / 14

    The laptop didn't come back

    A field officer is stopped at a checkpoint and her laptop is taken. It holds a beneficiary registration list. The room has to think about named people before it thinks about compliance.

    • Run this if staff carry laptops or phones with data into the field
    • Run this if you work where a device could be taken from someone
    • Carries a legal deadline
    Shape
    60 min · 9 updates
    In the room
    6 in the room
    Leans on
    Decide

  4. Cloud account takeover

    04 / 14

    Someone else is signing in as the Director

    An overnight login from a country you do not work in turns out to be genuine, and the account it belongs to can approve payments and read everything. The room has to lock a Executive Director out of her own organization before it can find out what the intruder already has.

    • Run this if you run on Google Workspace or Microsoft 365
    • Run this if a handful of people hold administrator access
    • Carries a legal deadline
    Shape
    60 min · 11 updates
    In the room
    6 in the room
    Leans on
    Decide

  5. Departing-staff insider access

    05 / 14

    She left on Friday. Her access didn't.

    A finance officer who resigned three weeks ago is still signing in, and a donor and beneficiary list has moved to a personal account. The room has to separate theft from sloppiness, and decide what it is willing to say about a former colleague.

    • Run this if people leave and you are not certain what access they keep
    • Run this if you use shared logins for anything
    • Carries a legal deadline
    Shape
    60 min · 10 updates
    In the room
    6 in the room
    Leans on
    Decide

  6. Vendor or implementing-partner breach

    06 / 14

    Our data, their breach

    The company that hosts your beneficiary database was breached eight days ago and has just told you, in one paragraph. The room has to work out what it is answerable for when the failure happened somewhere else, and how to press a supplier it has no leverage over.

    • Run this if a supplier or partner holds data about the people you serve
    • Run this if you use an external CRM, database or fundraising platform
    • Carries a legal deadline
    Shape
    60 min · 10 updates
    In the room
    6 in the room
    Leans on
    Decide

  7. Messaging account compromise

    07 / 14

    That message isn't from the Director

    The Executive Director's WhatsApp is answering messages she never sent, in the groups that coordinate field movements and partner payments. The room has to warn several hundred people on a channel it no longer controls, before someone tells the account where a convoy is.

    • Run this if you coordinate real work over WhatsApp or Signal groups
    • Run this if a manager runs groups that would matter if taken over
    • Carries a legal deadline
    Shape
    60 min · 10 updates
    In the room
    6 in the room
    Leans on
    Communicate

  8. Mobile-money and payment-list fraud

    08 / 14

    The transfers went to the wrong phones

    A cash-transfer run has paid 260 households and 41 of the numbers are not theirs. The room has to halt a payment channel that people are already queuing for, on the day they were promised money, and work out that the list was changed from inside.

    • Run this if you make cash or mobile-money transfers to people you serve
    • Run this if payment lists are prepared in spreadsheets
    • Carries a legal deadline
    Shape
    60 min · 10 updates
    In the room
    6 in the room
    Leans on
    Decide

  9. Public platform and social account takeover

    09 / 14

    Someone else is speaking as you

    Your main social account is posting, your website footer is pointing somewhere it shouldn't, and community members are already replying to both. The room has to take back its own voice, warn the people who trust it, and decide what it says publicly while it still does not know how this happened.

    • Run this if your website or social accounts are how your community reaches you
    • Run this if a hijacked account could reach people who trust you
    • Carries a legal deadline
    Shape
    60 min · 11 updates
    In the room
    6 in the room
    Leans on
    Communicate

  10. Accidental disclosure of personal data

    10 / 14

    It went to the wrong list

    A beneficiary list left the building by accident, to forty-seven people who should never have had it, and two of them have already replied to everyone. There is no attacker to blame and no system to shut down — only a notification clock that has already started and a colleague who is certain she has ended her career.

    • Run this if you hold personal data about the people you serve
    • Run this if you want to drill an incident with no attacker in it
    • Carries a legal deadline
    Shape
    60 min · 11 updates
    In the room
    6 in the room
    Leans on
    Protect

  11. Payroll diversion

    11 / 14

    The paycheck that never arrived

    A program officer says her salary is missing. Her bank details were changed three weeks ago by someone who was not her. By the end of the hour the room has to decide who is paid back, how the request was approved, and how many other people it happened to.

    • Run this if you employ people and pay them by bank transfer
    • Run this if bank detail changes are requested by email
    • Carries a legal deadline
    Shape
    60 min · 10 updates
    In the room
    6 in the room
    Leans on
    Protect

  12. Help-desk social engineering

    12 / 14

    Someone called IT and became the Finance Director

    A convincing phone call gets a colleague's login reset and their second factor moved to a new phone. By the end of the hour the room has to decide how anyone proves who they are, what to do about every other account reset this month, and who tells a board that the request sounded completely normal.

    • Run this if someone can reset a colleague’s password or second factor
    • Run this if IT support is one person, part-time or outsourced
    • Carries a legal deadline
    Shape
    60 min · 10 updates
    In the room
    6 in the room
    Leans on
    Decide

  13. Payment card abuse

    13 / 14

    Your donate button is being used to test stolen cards

    Hundreds of tiny donations arrive overnight and most of them fail. By the end of the hour the room has to decide whether to take the donation page down mid-campaign, what to tell donors whose cards were used, and who talks to a processor threatening to hold your funds.

    • Run this if you take card donations through your own website
    • Run this if your donation form has no minimum amount
    Shape
    60 min · 9 updates
    In the room
    6 in the room
    Leans on
    Decide

  14. Targeted harassment and doxxing

    14 / 14

    Your staff are being named online

    A post naming three of your staff and your office address is spreading, and the calls have started. By the end of the hour the room has to decide whether people come into the office tomorrow, what the organization says publicly, and who is responsible for a colleague who is frightened.

    • Run this if your work makes staff or the people you serve a target for who they are
    • Run this if your team's names, photos or office address are public
    Shape
    60 min · 9 updates
    In the room
    6 in the room
    Leans on
    Decide

The right first drill depends on your organization, not on an average.

If getting six people into a room is the hard part, start with a fifteen-minute drill instead — it needs one meeting you were already having. What follows is for the hour.

If you move money

Donor invoice fraud, then mobile-money fraud if you make field payments. Both start with a payment nobody questioned.

If you hold data about people

Accidental disclosure first — the most common real incident is a mistake, not an attacker — then device loss if staff carry data.

If you have a public voice

Public platform takeover. Your community watching it happen live is a different drill from anything internal.

Run your first drill