Your recovery plan is stored in the company drive. The contacts are in email. The password manager uses the same sign-in provider. Now imagine all three are unavailable.
That is a useful scenario for a team exercise, because it tests whether the plan survives the loss of the systems it depends on.
The NCSC published a new collection on highly disruptive cyber attacks on 1 October 2026. It covers recovery, preparation and reducing risk. The preparation guidance addresses people, plans and decision-making, including disruption caused by suppliers.
Pick a realistic starting point
The preparation guidance is written for leaders and security professionals in large organisations. A smaller business can still use the questions below to test its own arrangements at an appropriate scale.
Choose a scenario that fits your operation: staff cannot use the identity provider, the hosting panel is inaccessible, or a supplier has stopped a critical service. Describe what is known and what remains uncertain.
Keep the exercise verbal. You do not need to disable live accounts or interrupt customers to learn which decisions and dependencies are missing.
Find the first people you need
Ask who takes charge and how they contact the team. Can they find supplier contacts without signing into the failed system? Who can authorise emergency spending or a temporary service?
Use the actual people and services involved, but keep sensitive contact and recovery details in an approved location. The exercise should confirm access to those records without exposing them to everyone in the meeting.
Give a deputy the same task. A plan that works only when one administrator is available leaves the business with a fragile dependency.
Choose the first useful service to restore
Ask what the business needs to do first for customers. For a host, that might be receiving urgent support requests and checking service status. For a shop, it might be handling existing orders safely.
Then identify the systems that function needs: identity, network access, records, payment state or supplier services. Write the dependencies in the order they must become available.
Check the proposed workaround for accuracy and access control. A temporary process that loses orders or exposes customer records creates another problem to clean up later.
Leave the meeting with assigned fixes
A useful exercise ends with a short action list. Examples might include an accessible supplier contact record, a tested recovery account or a documented way to publish a service update when normal tools are unavailable.
Assign an owner and date to each gap. Run the exercise again after the fixes, with someone else leading it.
The purpose is to discover awkward dependencies while you have time to change them. If the team can explain how it communicates, makes decisions and restores a useful service without its everyday logins, the recovery plan has passed a meaningful test.
Reporting checked on 13 October 2026. The exercise is our practical adaptation of the NCSC's preparation themes.
