Disclaimer & FAQ

Purpose & Scope

This exercise is designed to support reflection and awareness training for the people who manage a business through disruption: crisis and incident managers, continuity leads, and the functional leads they depend on. It provides a structured decision-making exercise based on a realistic but entirely fictional scenario.

It is intended to complement — not replace — your organisation's own crisis management framework, business continuity plan, formal training, and exercises facilitated by qualified practitioners. Completing it does not constitute a business continuity exercise for the purposes of any standard, certification or audit.

Fictional Scenario

Exercise Lockout is entirely fictional. Harbourline Group, its systems, its people, its customers and the events of the scenario do not exist. Any resemblance to a real organisation, incident or individual is coincidental.

Accuracy & Currency

Decision options and feedback panels reflect widely used crisis management and business continuity practice, including ISO 22301, ISO 22361, NCSC incident management guidance and ICO breach reporting guidance, as understood at the time of writing. Where a legal duty is described, the feedback names the source. This content may become outdated as standards, legislation, regulatory guidance and good practice evolve.

Users should always verify decisions and procedures against their organisation's own plans, current legislation and regulatory guidance, and qualified professional advice. The exercise content should not be used as the sole basis for any real-world decision, and in particular is not legal advice on notification, contractual or insurance obligations.

No Liability

The tool is provided as-is, without warranty of any kind — including as to completeness, accuracy, fitness for a particular purpose, or freedom from error. The creator accepts no liability for any loss, harm, or consequence arising from use of this tool, reliance on its content, or decisions made in real incidents by individuals or organisations who have used this exercise.

The scoring system and outcome ratings are designed to support reflection and discussion. They should not be used to assess individual competence, make employment decisions, or form part of any formal performance record.

Data & Privacy

This tool does not require an account or log-in, and it uses no tracking cookies or cross-site advertising trackers. To understand how it is used and improve it, we may collect a small amount of anonymous data:

• Aggregate traffic analytics — cookieless page-view and referrer counts. No personal data, no cookies, no consent banner required.
• Anonymous usage events — which role is chosen, question progress, and completion — so we can see which content is used and where people drop off. These contain no personal or identifying information.

The only time you would send us personal information is if you choose to submit feedback through a feedback form, where one is offered: it asks for a name, email and message, which are sent to our feedback service so we can read and respond. Feedback is entirely optional.

Your exercise results and decision log exist only in the browser tab you are playing in. They are not transmitted, and they are not saved to your device either — closing or reloading the tab discards them. If you want to keep a record, use Save Result as PDF on the results or decision-review screen before you leave; where that file goes is entirely your choice.

Intellectual Property

The exercise engine, scenario content, question bank, consequence models, and all associated materials are the intellectual property of Ben Phipps © 2026. All rights reserved. The tool is made available for non-commercial training and awareness use. Reproduction or adaptation of the content for commercial purposes, or use in formal accredited training programmes without permission, is not permitted. Contact us to discuss licensing, commissioning or a version tailored to your organisation.