simler

Platform

Boardroom ReadinessCrisis Readiness

NIS2

Cbw checkBoard training
Pricing
Book a demoStart freeLog in

Boardroom Readiness

Practice a cyber crisis with your board, in 30 to 60 minutes.

The executive team and management work through a realistic incident together, round by round. An AI facilitator asks the questions that come up in a real crisis: who decides, who do you inform, and do we pay?

Book a demoGenerate a scenario for free

Northwind Logisticsfictional company

Round 1 of 2 /Monday 08:30

A ransom message and a first customer question

At 07:15 an anonymous message came in: the sender has customer and shipment data from the planning platform and threatens to publish it within 96 hours unless they're paid. The sample data they sent looks real, and a buyer at a major retail customer is already calling with questions.

What's known

  • The message is credible
  • The sample data looks real

What isn't known

  • How much data was stolen
  • Whether the attackers still have access

The board decides now

  • Who takes the lead today?
  • Do we formally engage the incident response firm?
  • What do we tell the retail customer?

FacilitatorAI

Who leads the crisis from now on, and who takes over if that person can't be reached this afternoon?

At the table

CEOCFOHead of CommunicationsHead of ITLegal & Compliance
A fictional logistics company, a board at the table and a threat to publish customer data. Click through the rounds and see what goes into the debrief.

The board is accountable. Has it ever worked through a crisis together?

  • NIS2 puts it on the board

    Board members approve the measures, oversee them and must be demonstrably trained. Under the Dutch Cyberbeveiligingswet (Cbw), they can be held personally accountable.

  • The hardest questions only come when it's real

    Do we pay or not? When do we report to the regulator? What do we tell customers and the press? Without practice, those questions get asked for the first time when the clock is already running.

  • Who decides what isn't clear

    The crisis plan names roles and mandates. But does everyone at the table know who leads the crisis, and who takes over if that person can't be reached?

How a tabletop exercise works

  1. 1

    Add your plans

    Optional

    Your information security policy, incident response plan, business continuity plan and disaster recovery plan make the scenario specific to your organization. Don't have them yet? simler drafts them with you.

  2. 2

    Choose a focus

    Data theft and extortion, for example. simler builds the scenario for your board, with the plans you added.

  3. 3

    Round by round, around one screen

    Everyone sees the same situation and plays themselves. Each round, the AI facilitator asks a question, responds to the discussion and sums up what was decided.

  4. 4

    The debrief is ready right away

    Decisions made, open and closed questions and the documents used are there as soon as you finish. simler also assesses how the room worked: decision-making, role clarity and escalation.

  5. 5

    A report for the board and the regulator

    Download the debrief as a PDF: a record that the board practices, with the points that are still open.

Debrief Northwind Logistics.pdf

Sample

Tabletop exercise debrief

Threat to publish customer data

Northwind Logistics · 30 minutes · 5 participants

1 · What you decided

  • The CEO leads the crisis; the CFO takes over in their absence
  • The incident response firm is formally engaged

2 · What stayed open

  • Contact with the extortionists: who makes that call?

3 · How the room worked

  • Decision-makingDeveloping
  • Role clarityNeeds attention
  • EscalationStrong

Based on: Crisis plan, business continuity plan

Start with the NIS2 board training

A three-hour session for your full board: what NIS2 asks, where you stand and what you're liable for, followed by an exercise. With a certificate for every board member.

€1,495 one-off (regularly €2,950)

Take out a subscription within 60 days and we credit the full amount.

See the training

Boardroom Readiness

For organizations that want their board to practice throughout the year.

€249/ month in the first year

40% off in the first year

€2,988 in the first year, then €4,980 per year. Billed annually, excl. VAT.

Book a demoSee all pricing
  • Unlimited tabletop exercises
  • Scenarios based on your own crisis plan and business continuity plan
  • An AI facilitator that asks, responds and sums up
  • Debrief with decisions, open questions and three themes
  • Report as a PDF for the board and the regulator
  • Up to 10 participants per exercise and 15 accounts
Want the rest of your organization to practice too, each in their own role? Crisis Readiness includes both. See Crisis Readiness

Frequently asked questions

Who takes part?

The executive team and management, up to 10 people per exercise. Everyone plays themselves; simler doesn't play any roles.

How long does an exercise take?

You choose 30, 60, 90 or 120 minutes. A round takes about ten minutes; for a board, 30 or 60 minutes works well.

Does someone on our side have to run the exercise?

Someone starts the session and moves the rounds along. The AI facilitator asks the questions, responds to the discussion and sums up each round.

How is this different from the NIS2 board training?

The training is a guided three-hour session: knowledge of NIS2 and liability, a baseline assessment and an exercise, with a certificate for every board member. With Boardroom Readiness, the board then practices on its own, as often as you like.

Can we practice in Dutch or English?

Yes, either. The scenario, the facilitator's questions and the debrief are fully in the language you practice in.

Does a tabletop exercise count for NIS2?

Every exercise produces a debrief and a report: a record that the board practices, and which points are still open. What your regulator expects exactly differs by sector.

Can we try it first?

Yes. With a free account you generate a tabletop scenario for your own organization and review all of it. Starting it requires a subscription. You can play a ready-made tabletop exercise for free, debrief included.

See in 30 minutes how simler fits your organization

We show you what an exercise for your organization looks like, from scenario to debrief.

Book a demoOr start free with a demo exercise
  • Built in the Netherlands
  • Exercises in Dutch or English
  • Aligned with NIS2 and the Dutch Cyberbeveiligingswet