Train for a cyber crisis before it actually happens
Cyber crisis readiness isn’t built on paper, but through realistic exercises that test decision-making and collaboration.
Our valued customers:
The fire alarm blares, and this time it's for real. Practice determines what happens next.
Smoke in the hallway, doubt in your mind: where should I go, who’s in charge? This is what a cyber crisis feels like when you’ve never practiced together. What does your organization do if a critical supplier goes down? Who takes control, who communicates, who decides?
CCRC ensures you don’t have to figure that out for the first time when things are already going wrong.
We help every type of organization with the right cyber crisis exercise
An interactive crisis experience
For organizations, industry associations, and events where people want to experience for the first time what a cyber crisis truly means. In a short, interactive session, we’ll help you experience the impact of pressure, uncertainty, and coordination, possibly in collaboration with your supply chain partners.
Result: reality check, sense of urgency and first points for improvement.
To product page
Understanding together what needs to be done
For teams that need a shared understanding of roles, mandates, and initial actions during a cyber incident. We clarify who does what, when, and why – also suitable for practicing with chain partners.
Result: insight into whether everyone knows what is expected of him or her, and where the gaps are.
To product page
Practice realistically with your own plan
For organizations with existing plans and runbooks that want to know if they work under real pressure. We practice realistic scenarios based on your context and refine what proves impossible in practice.
Result: plans that work and a team that can execute them.
To product page
Structural improvement
For organizations that want to establish cyber crisis readiness as an ongoing capability. We develop a regular exercise and improvement cycle, including evaluation, repetition, and collaboration.
Result: ingrained routines, measurable progress and predictable response.
To product page
Practising where dependency becomes risk
For organisations that want to practise together with suppliers, partners, or other chain parties how a cyber crisis plays out across the chain. We bring parties together and test how information sharing, decision-making, and continuity actually work beyond organisational boundaries.
Result: less uncertainty, better collaboration, and more control over chain continuity.
To product page
Organizations that completed our cyber crisis training or simulation
Downloads of knowledge package
Average training rating
Guided by people who know what a crisis feels like
Our trainers are not junior facilitators or theoretical advisors. They are experienced crisis professionals who have served in crisis teams themselves and know the pressure of when things truly go wrong. This allows them to sense exactly what a group needs for effective practice: when to push forward, when to slow down, and when a discussion needs to become sharper to reach real insights.
And because we don’t sell security tooling or incident response, we have no stake in what happens after the exercise, other than your team coming out stronger. During an exercise, no one is observing with something to sell you afterwards. Only people who have stood in crisis teams themselves. If questions come up that fall outside our scope, we’re happy to think along and point you to parties who do specialize in it. No stake, no commission.
About us
"We want a cultural shift: from reacting to cyber incidents to being prepared. This means that practicing becomes just as normal as reporting or auditing."
What our clients say
Practicing should be possible for everyone
Not every organization has the budget or resources for extensive simulations or multi-year programs. Yet, a cyber crisis does not discriminate. Through its foundation, CCRC is committed to making exercises accessible to organizations with a social role and limited resources. Because being prepared should not be a privilege.
More about the foundation
Prepare yourself with our knowledge and materials
Practical tools, real-world experiences, and concrete templates to better prepare your organization for a cyber crisis.
Cyber Crisis?
Don't Panic!
Practical handbook with explanations and immediately applicable templates for roles, decision-making, and communication.
Download the handbook
What do you do during a cyber incident?
Participant experiences showing how organizations respond during a cyber incident.
Download whitepaper
What if you are the next target of a cyber attack?
Insights into supply chain vulnerability and case studies on the impact of cyber attacks.
Download whitepaper
First Aid Cyber Crisis Guide
Compact guide for the crucial decisions in the first hour of a cyber crisis.
Download crisis guide
Frequently asked questions
CCRC offers five formats that build on each other: Event (one-off awareness experience), Exercise (first structured practice), Simulation (testing your own plan), Program (recurring exercise cycle), and Chain (practicing with suppliers and partners). Organizations typically start with Event or Exercise and grow toward Program as crisis readiness matures.
It depends on your starting point: no prior practice suggests Event or Exercise; an existing crisis plan that needs testing suggests Simulation; ongoing governance needs suggest Program; dependency on suppliers or partners suggests Chain. CCRC helps determine the right fit in an introductory conversation.
For organizations under NIS2, yes. The Dutch Cybersecurity Decree requires essential and important entities to have a business continuity plan, apply it, and test it periodically. A plan that has never been practiced does not meet this requirement.
CCRC works with organizations that play a critical role in their sector or chain: financial institutions, healthcare organizations, industrial companies, government agencies, and logistics providers, among others. A shared trait is that a cyber crisis for them affects more than just their own organization.
Yes, several formats (such as Event and Program) can be delivered fully online or hybrid. Exercise and Simulation are preferably conducted on location for maximum realism, though online delivery is possible depending on the scenario and team distribution.
Pricing depends on the format (Event, Exercise, Simulation, Program, or Chain), group size, and scenario complexity. CCRC doesn't publish fixed rates; after an introductory conversation, you receive a tailored proposal matched to your organization's situation.
Every CCRC format ends with concrete findings, from a first reality check after an Event to specific plan improvements after a Simulation. These findings form the basis for the next step, whether that's a follow-up exercise, plan revisions, or moving toward a structural Program.
CCRC's formats span the same spectrum used industry-wide: Exercise resembles a facilitated, discussion-based tabletop exercise, while Simulation and Program add the realistic pressure and repetition of a full-scale rehearsal, tailored specifically to cyber crisis roles and the BOB decision method.
Where many providers offer crisis exercises as an add-on to broader security services, CCRC focuses exclusively on cyber crisis exercises. That singular focus shapes every format, trainer, and scenario CCRC builds.
Yes. Chain is CCRC's dedicated format for practicing with suppliers and partners, testing how information sharing, decision-making, and continuity hold up when a crisis crosses organizational boundaries.
