Train for a cyber crisis before it actually happens
Cyber crisis readiness isn’t built on paper, but through realistic exercises that test decision-making and collaboration.
Our valued customers:
The fire alarm blares, and this time it's for real. Practice determines what happens next.
Smoke in the hallway, doubt in your mind: where should I go, who’s in charge? This is what a cyber crisis feels like when you’ve never practiced together. What does your organization do if a critical supplier goes down? Who takes control, who communicates, who decides?
CCRC ensures you don’t have to figure that out for the first time when things are already going wrong.
Choose the approach that fits where your organization stands
Practice your crisis approach as it should work in reality
A realistic, tailored cyber crisis, practiced with your own plan, processes, and crisis team.
Structural practice, better prepared every year
Recurring simulations that evolve every year with the reality of your organization.
Practice together with your supply chain partners
One crisis scenario, practiced with the crisis teams of two or more organizations in your chain.
Help with your crisis organization, from strategy to playbook
From a departing CISO to a playbook that didn’t work in an exercise: we step in to address the issues that arise before, or alongside, the training.
Organizations that completed our cyber crisis training or simulation
Downloads of knowledge package
Average training rating
Guided by people who know what a crisis feels like
Our trainers are not junior facilitators or theoretical advisors. They are experienced crisis professionals who have served in crisis teams themselves and know the pressure of when things truly go wrong. This allows them to sense exactly what a group needs for effective practice: when to push forward, when to slow down, and when a discussion needs to become sharper to reach real insights.
And because we don’t sell security tooling or incident response, we have no stake in what happens after the exercise, other than your team coming out stronger. During an exercise, no one is observing with something to sell you afterwards. Only people who have stood in crisis teams themselves. If questions come up that fall outside our scope, we’re happy to think along and point you to parties who do specialize in it. No stake, no commission.
About us
"We want a cultural shift: from reacting to cyber incidents to being prepared. This means that practicing becomes just as normal as reporting or auditing."
What our clients say
Prepare yourself with our knowledge and materials
Practical tools, real-world experiences, and concrete templates to better prepare your organization for a cyber crisis.
Cyber Crisis?
Don't Panic!
Practical handbook with explanations and immediately applicable templates for roles, decision-making, and communication.
Download the handbook
What do you do during a cyber incident?
Participant experiences showing how organizations respond during a cyber incident.
Download whitepaper
What if you are the next target of a cyber attack?
Insights into supply chain vulnerability and case studies on the impact of cyber attacks.
Download whitepaper
First Aid Cyber Crisis Guide
Compact guide for the crucial decisions in the first hour of a cyber crisis.
Download crisis guide
Frequently asked questions
CCRC offers five formats that build on each other: Event (one-off awareness experience), Exercise (first structured practice), Simulation (testing your own plan), Program (recurring exercise cycle), and Chain (practicing with suppliers and partners). Organizations typically start with Event or Exercise and grow toward Program as crisis readiness matures.
It depends on your starting point: no prior practice suggests Event or Exercise; an existing crisis plan that needs testing suggests Simulation; ongoing governance needs suggest Program; dependency on suppliers or partners suggests Chain. CCRC helps determine the right fit in an introductory conversation.
For organizations under NIS2, yes. The Dutch Cybersecurity Decree requires essential and important entities to have a business continuity plan, apply it, and test it periodically. A plan that has never been practiced does not meet this requirement.
CCRC works with organizations that play a critical role in their sector or chain: financial institutions, healthcare organizations, industrial companies, government agencies, and logistics providers, among others. A shared trait is that a cyber crisis for them affects more than just their own organization.
Yes, several formats (such as Event and Program) can be delivered fully online or hybrid. Exercise and Simulation are preferably conducted on location for maximum realism, though online delivery is possible depending on the scenario and team distribution.
Pricing depends on the format (Event, Exercise, Simulation, Program, or Chain), group size, and scenario complexity. CCRC doesn't publish fixed rates; after an introductory conversation, you receive a tailored proposal matched to your organization's situation.
Every CCRC format ends with concrete findings, from a first reality check after an Event to specific plan improvements after a Simulation. These findings form the basis for the next step, whether that's a follow-up exercise, plan revisions, or moving toward a structural Program.
CCRC's formats span the same spectrum used industry-wide: Exercise resembles a facilitated, discussion-based tabletop exercise, while Simulation and Program add the realistic pressure and repetition of a full-scale rehearsal, tailored specifically to cyber crisis roles and the BOB decision method.
Where many providers offer crisis exercises as an add-on to broader security services, CCRC focuses exclusively on cyber crisis exercises. That singular focus shapes every format, trainer, and scenario CCRC builds.
Yes. Chain is CCRC's dedicated format for practicing with suppliers and partners, testing how information sharing, decision-making, and continuity hold up when a crisis crosses organizational boundaries.