Everything you need to get the most out of the Corporate Resilience Exercise.
Keep the Lights On is a tabletop decision-making exercise for the people who run a business through a crisis. It puts you in the seat of a named role during a realistic incident and asks you to make the decisions that role actually faces — under time pressure, with incomplete information, and with consequences that carry forward.
It is designed to be picked up off the shelf with no facilitator, no preparation and no specialist knowledge. A single run takes around 15–20 minutes.
Exercise Lockout — On a Monday morning, ransomware locks the core systems of Harbourline Group, a fictional mid-size distribution and services business. Finance, dispatch, email and payroll are down, a ransom demand arrives, and customer data may have been taken. You manage the response from the first alert through containment, recovery and the return to normal.
Before play begins you are shown two framing cases: a strategic worst case (the ceiling — every system down for weeks, data published, the survival of the business in question) and a realistic worst case (the scenario you actually play — serious but recoverable, with real pressure on people, service and reputation).
This framing helps you calibrate your response — neither overreacting nor underplaying the incident.
Decisions compound. A poor call in Phase 1 follows you into Phase 3. The exercise rewards early, proportionate action — exactly as real incidents do.
The scenario runs in four phases that mirror the lifecycle of a real business crisis — from the first alert to the review afterwards. Each phase presents a decision appropriate to that stage.
Your early decisions follow you. Skip invoking the crisis plan in Phase 1 and later questions carry a warning that decisions are unowned; leave staff without instruction and the situation panel keeps reminding you. The situation text itself changes tone as the response strains.
This is intentional. It reflects how real incidents work: early decisions foreclose later options.
A service status board appears between phases — the board every crisis room has on the wall, showing which of the organisation's critical services are running, degraded or down, and what has changed since the last update. It is the situational update a real crisis team would receive at a briefing, and the next phase's decisions reflect it.
Each question presents a situation and three options. There are no trick answers. Every option reflects a real approach that organisations have taken in actual incidents — some better than others.
The textbook response: proportionate, timely, and consistent with good crisis and continuity practice. Typically improves one or more of the four consequence bars. Explained in the feedback with the reasoning behind it.
A defensible decision that is not wrong, but misses the optimal response — often because it is too slow, too cautious, or addresses only part of the problem. Consequence bars shift against you.
An approach that is actively harmful, steps outside the role's authority, or reflects a common misunderstanding of how a crisis response works. Consequence bars shift sharply. Detailed feedback explains what went wrong and why.
Some questions have a countdown, shown as a bar draining across the top of the screen. These simulate decisions with a real deadline — a containment call, a statement that has to go out before the story does.
The clock only starts once you reveal the options, and you get a moment to read them first. If it expires before you choose, the question is scored as a timeout with double consequences — in real incidents, not deciding in time is itself a decision.
Timed questions appear in Phase 1, where the pressure is greatest.
After every answer you receive a feedback card explaining why the best option was optimal, what the others got wrong, and the framework principle behind the decision — your organisation's own crisis and continuity framework first, then the public standards and guidance it draws on.
Feedback is a core part of the learning experience. Even if you chose correctly, read it — the reasoning is often as valuable as the answer.
The exercise uses the strategic / tactical / operational structure that crisis management standards describe. The strategic level sets direction and owns the hard calls, the tactical level runs the response, the operational level delivers within each function. Each level has different decisions, different information, and different responsibilities.
Sets objectives, decides what the organisation will and will not do, and owns the decisions the board, the regulator and the press will later scrutinise. Chairs the Crisis Management Team. Does not run the technical response.
Turns strategic objectives into a coordinated response. Runs the Incident Management Team, keeps one log and one picture, and resolves conflicts between functions. Communications and legal sit here because their decisions cut across every function.
Delivers the response inside a function — containing the attack, instructing staff, securing the buildings, keeping the depots running. Reports upward to the tactical level and makes fast decisions within the framework it sets.
Each role faces a completely different set of decisions — playing the same scenario as two different roles is a very different exercise. For a team session, consider assigning roles to match people's actual jobs, or deliberately assigning unfamiliar ones to build understanding across functions. The exercise works for both.
Your performance is tracked in two ways: a points score for your individual decisions, and four consequence bars that represent the cumulative impact of your choices on the organisation.
Four bars run continuously during the exercise, starting at a low baseline and rising or falling with each decision. They represent the real dimensions of harm in a business crisis:
The bars drive the tone of the exercise. As they rise, the situation text starts to read as though the response is straining, and the debrief names the dimension where the run suffered most.
Each question scores 0–20 points and carries a label:
| 20 | Textbook Response | Optimal response — exactly right |
| 16 | Excellent Call | Strong decision with minor trade-offs |
| 12 | Solid Decision | Good but not optimal |
| 8 | Costly Delay | Defensible but creates downstream problems |
| 4 | Serious Error | Actively harmful or structurally wrong |
| 0 | Critical Failure | Undermines the whole response |
| — | Time Expired | No decision made — double consequences |
At the end of the exercise, your points and your consequence bars together produce a final impact rating on a five-band scale — from Negligible down to Catastrophic. The points gate scales to the number of questions in your role, so a shorter role played well is recognised as such.
Each question includes a situation panel showing the time, what is down, what still works and who is asking for what. The right answer often depends on details in that panel — a deadline, a fallback that already exists, a number that changes the calculation.
A decision that scores partial credit can still push a bar towards critical. A high score with a spiked People bar is a different outcome from a high score with every bar green. The bars are the real performance measure.
Options are shuffled on every load, and the best answer is never the longest by design. Approach each question as you would in a real crisis meeting: what does this situation actually require, and what is within my role's authority to decide?
The strategic level does not run the technical response. The operational level does not decide whether to pay a ransom. Many poor answers involve stepping outside your level — running the server room as the CMT Chair, or making the disclosure decision as the IT lead. If an answer feels like it belongs to a different level, it probably does.
The exercise consistently rewards early, proportionate action over cautious delay. Waiting for certainty before invoking the plan, telling staff, notifying the insurer or triggering a standby arrangement is the most common way to accumulate poor scores. Late-but-complete is usually worse than early-and-honest.
Play solo, then compare answers with colleagues. Disagreements about the correct option are often the most productive conversations — especially across functions, where assumptions about who decides what diverge. The decision review and the PDF record give you the material.
Playing the Incident Manager after playing the IT & Cyber Lead — or vice versa — reveals how the same incident looks from different seats. This cross-role perspective is one of the most effective things you can do with the exercise in a team setting.
The exercise includes prompts to test your organisation's crisis framework and continuity plan. They are not rhetorical — bring the actual documents to the table and check them against each decision. The gaps you find are the most useful output of the exercise.
The results screen appears automatically when you finish, with your impact band, your score, the four consequence assessments and your key learning points. Review Decisions then opens the full decision log — what you chose, the best answer, why, and the framework principle behind it.
Both screens carry a Save Result as PDF button. It opens your browser's print dialogue with "Save as PDF" as the destination, and produces a one-file exercise record.
If you are using this as part of a planned exercise, send that PDF to whoever is running it. Nothing is saved once you close the tab, so take the PDF before you leave.