1. Exercise modes
2. Scheduling an exercise
3. Running an exercise
4. Reviewing the team’s performance
5. Facilitator resources

There are three ways to run an exercise:

• Single player mode tests an individual’s incident response. Participants complete the exercise independently, allowing you to understand their unique approach to situations.
• Drill mode is for scenarios with multiple predefined roles. You assign a specific role to each participant to evaluate their responses during an incident. This mode is ideal for testing communication and response times, and identifying skill gaps.
• Presentation mode is live and interactive. As the facilitator, you present an exercise using videoconferencing tools, where participants vote for the next action in an incident.

Presentation mode is best for most groups. Participants vote using a companion web app, and the facilitator guides the group through the narrative.

To set up a scheduled exercise for your team based on one of the scenarios in the Crisis Sim catalogue, do the following:

1. If you haven’t already done so, request access in ESC.
2. Browse the available scenarios in the scenario catalogue. Filter by UoT to find our customized ransomware scenario.
3. Click the scenario you want to run.
4. Click Select to schedule an exercise based on the scenario. (You can also click Preview to familiarize yourself with the scenario and presentation tools.)
5. Pick your mode (ransomware is either single player or presentation).
6. Enter title, start date, due date and (optional) participant names.
7. Review the details and click Publish.

To run your scheduled exercise, do the following:

1. Go to your manager page to locate your scheduled exercise.
2. Click the exercise, then click Play.
3. Choose single screen or facilitator view.
4. A QR code and URL for participants show up on screen, with a passcode.
5. The participants navigate to the web application, enter the passcode and are ready to go.

Your role as a facilitator involves keeping participants informed about the scenario while injecting realistic events or incidents to assess their response. Use injects/interviews strategically to challenge participants and identify knowledge gaps.

As a beginner, focus on mastering the conduct of existing scenarios before creating your own complex situations. This approach ensures a smooth introduction to the system and helps build confidence in facilitating scenarios.

Conduct a review session (an after-action review) with the team to analyze the results of your exercises. The session(s) can be as formal or informal as you’d like. To help you, the tool automatically generates an after-action report (link to sample report) within 20-30 minutes of the end of the exercise. The report includes decision scores, confidence ratings, justifications and more.

The after-action report serves as a roadmap to identify improvement areas. Leverage the compiled data and metric details to understand where the team excelled and the areas that need reinforcement.

You may wish to run the review session immediately following the exercise, or wait a few days to give the team time to digest their experiences and better prepare for a constructive discussion.

Here are some resources to help you run effective exercises and after-action reviews:

• Optiv Security and University of Toronto: Facilitator’s guide
• National Wildfire Coordinating Group: After action reviews
• UNICEF toolkit: After action review (download link on page)
• LogRocket: A guide to conducting an effective after-action review (AAR)

There is no one right way to do this; you’ll learn what works best for you as a team.