CRISIS TABLETOP ORIGINAL · THIRD-PARTY & OPERATIONAL RISK
A strategic vendor becomes unavailable across regions. The provider cannot give a reliable restoration estimate, contractual remedies do not restore service, customers and regulators demand evidence, and a possible subcontractor compromise forces the organization to choose between risky partial recovery and an expensive migration.
EXERCISE PURPOSE
A critical cloud provider suffers a prolonged outage complicated by weak transparency, possible data compromise, subcontractor failure, and an untested exit plan
DECISION PRESSURE
The facilitator releases facts in stages. Participants should identify the decision owner, the authority being used, the information still needed, the immediate action, and the next escalation point.
Which services fail first and who can activate workarounds?
Can the organization administer or recover critical systems without the vendor?
Do contract rights yield useful evidence, assistance, or transition support?
When does a service outage become a security, privacy, or disclosure event?
What conditions justify risky restoration, emergency replacement, or termination?
INSIDE THE EXERCISE
The template is already populated with public injects, facilitator-only context, discussion prompts, private role messages, and a final hotwash.
Users cannot access the organization’s strategic cloud platform. Automated monitoring shows failures in two regions, but the vendor status page reports only minor performance degradation.
The vendor confirms a significant incident but will not provide a cause, scope, or restoration estimate. It asks customers not to open duplicate support tickets and promises another update in four hours.
Manual intake and spreadsheets keep priority work moving, but queues are growing quickly. Some teams begin copying production data into unsanctioned tools and personal accounts.
Three major customers invoke contractual continuity and notification provisions. One demands an executive bridge and a written restoration estimate within an hour. Another threatens to suspend transactions and seek damages.
The architecture team says an alternate provider could support the service, but credentials, data replication, licensing, network routes, and customer validation are incomplete. An emergency migration may take 24 to 72 hours and could lose recent transactions.
The vendor reports that the outage began after suspicious activity in a management environment. It cannot yet rule out unauthorized access to customer data or administrative functions.
The vendor says a previously undisclosed infrastructure subcontractor is central to the incident. The subcontractor is not responding to the organization and the vendor will not provide its investigation report.
PARTICIPANTS
Assign people to functions, not titles alone. If one person owns several functions, keep the roles distinct during discussion so conflicts and handoffs remain visible.
REAL-WORLD INCIDENTS
Use these cases during planning or the prebrief. They are factual anchors, not scripts. Adapt the scenario to the organization’s technology, industry, geography, contracts, regulators, and risk profile.
GAO described a faulty security-software update that crashed Windows systems and disrupted flights, hospital care, and other critical operations.
AWS December 2021 US-EAST-1 event↗AWS’s post-event summary offers facts for testing regional concentration, control-plane dependencies, status communications, and recovery sequencing.
LEGAL, REGULATORY & STANDARDS LENS
Applicability depends on the organization and facts. Use counsel and subject-matter owners to tailor deadlines, thresholds, privileges, preservation, reporting, and communications.
Cybersecurity supply-chain risk management guidance for identifying, assessing, responding to, and monitoring supplier risk.
EU Digital Operational Resilience Act↗DORA requires covered financial entities to maintain and periodically test ICT business-continuity and response-and-recovery plans, including third-party failure scenarios.
NIST SP 800-61 Rev. 3↗Current NIST incident-response recommendations tie preparation, response, recovery, and continuous improvement to the Cybersecurity Framework.
PRACTITIONER PERSPECTIVES
External perspectives help the design team challenge internal assumptions. They do not replace organization-specific legal or technical advice.
EXPECTED OUTPUT