Poro Advisory

Cyber Awareness for the Boardroom · Guide 4

Exercise completed. Are we ready to decide?

A practical guide to decisions under pressure and evidence of improvement.

A completed cyber exercise shows that a session happened, not that the organisation can make and carry out decisions under pressure. For bank boards and senior executives, the useful question is what the exercise demonstrated about authority, information and the ability to act while facts remain uncertain.

5-page PDF Prepared by Professor Buck Rogers
Get the guide
Front cover of the Poro Advisory guide: Exercise completed. Are we ready to decide?

What's inside

  • Decisions and improvement

    Exercise a decision that matters, make uncertainty part of the discussion and turn findings into checked improvements.

  • Evidence of decision-making

    Look at decision authority, the information and time available, and which actions can actually be carried out.

  • Three board questions

    Which consequential decisions were practised, where could waiting leave no useful option, and what has changed since?

  • Ten minutes at the next meeting

    A timed discussion around a containment decision, with a practical follow-up record for your board.

The key insight

An exercise that exposes a weakness can be valuable. A reassuring session may have tested too little.

Get your free copy

Tell us where to send it and we'll email you the download link straight away.

We'll only use your details to send the guide and occasional Poro Advisory insights. No sharing, ever.

From the guide

Cyber exercises and board assurance: beyond completion

A board paper reporting that the cyber exercise is complete answers the easiest question. The harder one is what the exercise demonstrated about the organisation's ability to decide and act: who acted, what information they used, and whether they could agree a course of action while important facts remained uncertain.

The questions a board should ask

Which consequential decisions did we practise, and what did we observe? Where could waiting, unclear authority or an untested assumption leave us without a useful option? And what has changed since the exercise — with an accountable owner, evidence of implementation and a proportionate practical check?

The evidence to request

  • A short decision log: the facts available at the time, important assumptions, options considered and reasons for the choice.
  • Whether participants identified the decision owner, reached the right people and worked within the agreed delegation — including when an owner was unavailable.
  • What was simulated, assumed or outside scope, and whether actions discussed can actually operate at the required capacity.

A practical scenario

Illustrative scenario from the guide

At 10:00, the security team finds suspicious administrator activity on a system supporting a critical customer service. Restricting access could contain the incident but would interrupt the service; more evidence is expected in 45 minutes. A prepared workaround takes 30 minutes to activate, unacceptable customer impact could begin at 11:00, and the usual incident executive cannot be reached. What do you decide, and who can authorise it?

Buck's interpretation

Fast decisions can still be poorly informed, and a slower response may be justified if the team recognises the consequences and retains useful options. A sound response weighs containment and customer consequences together, uses the agreed alternate authority, and records the decision, its rationale and a review trigger before the useful action window closes. Waiting for the next update is a decision too — and it should be recorded as one.

The full guide includes all three board questions, the structured ten-minute discussion, a response checklist and a practical follow-up record.

Download the full guide