A half-day expert workshop where leadership, IT and operations run a simulated security incident against their own incident plan and leave with a list of changes to it.
An incident plan that has never been exercised is a document, not a capability. This workshop runs one: in a half-day, the people who would handle a real incident face a scenario built on their own organization, make the calls in real time, and find out where the plan holds and where it does not. The facilitator is a practitioner who has handled incidents and run exercises for other organizations.
It pairs with the Incident Response and Disaster Recovery course, whose capstone is a playbook, a recovery plan and a tabletop debrief. Participants who took the course exercise the plan they built; a group booking the workshop on its own exercises the plan it has. Either way it leaves with a list of changes, and a management team that has been through it once.
Live, with a practitioner facilitator, for one group of up to 20
Exercises adapted to your own cases in a scoping call
An impact report within a week
A certificate is issued to participants who attended and completed the exercise, and recorded on the TechClass platform.
Agenda
Block 1
Opening
Goals, your group's context, and what participants will leave with.
15 min
Block 2
Learn
The incident lifecycle, the roles in it, and the reporting deadlines that apply, including NIS2 and DORA where they do, on a real incident walked through step by step.
50 min
Block 3
Practice
The tabletop itself: a scenario briefing, timed injects, decisions made under pressure, and the communications that go with them.
60 min
Block 4
Apply
The lessons learned, written as changes to the incident plan: what was missing, what was unclear, and who fixes it.
45 min
Block 5
Close
Summary, commitments and feedback.
15 min
3.5 hours including two breaks: a morning from 9:00 to 12:30 or an afternoon from 13:00 to 16:30, in your time zone. Practice and Apply take more than half of the working time. You leave with a list of changes to your incident plan.
Applies this Skills course
The workshop is the live, hands-on application of this course. In a blended program the course is the pre-work; the workshop is where the group puts it to work on its own cases.
Leadership, plus the IT and operations staff with a role in the incident plan
Anyone who would be in the room when a real incident hits
Security cohorts in a continuous learning program
Fee and registration
Quote on request
Price For up to 20 participants, with a fee for each extra participant up to 30. In person adds travel at cost. There are no design fees: adapting the exercises to your cases is part of every workshop.
Per workshop, quoted on inquiry
Pre-work In a blended program the Skills course is the pre-work and its licenses are quoted with the workshop. A standalone workshop uses a short Essentials course, included with every license.
The Skills course, or an Essentials course
Group
Up to 20 per facilitator; 21 to 30 with a second facilitator
How to book
01
Get in touch
Tell us the workshop, the group and whether you want it online or on site. We come back with a proposal: the date and slot, the delivery, the facilitator and the price.
02
Scoping call
Three to four weeks before the day, a 30-minute call about your goals, the group and its own cases. The facilitator adapts the exercises to them.
03
Pre-work and the half-day
Participants are enrolled on TechClass and take the pre-work one to two weeks before. Then the workshop itself: 3.5 hours, a morning or an afternoon in your time zone.
04
Certificates and the impact report
Within a week: certificates for participants who attended and completed the exercise, feedback collected, and a short report of attendance, feedback, what was produced and the agreed next step.
Workshops serve companies and education organizations alike. A cohort in a continuous learning program books the same workshop; the institution stays responsible for its program and any credit.
Yes. The scoping call before the day brings your own cases into the exercises, and the facilitator adapts them. The topic and the length stay the same. A topic outside the catalog is scoped and quoted separately.
In a blended program, yes: the course is the pre-work and the workshop applies it. For a standalone workshop, participants take a short Essentials course on the same subject one to two weeks before; Essentials courses are included with every TechClass license.
Up to 20 participants with one facilitator, and 21 to 30 with a second facilitator. Above 30 it is no longer a workshop; ask us about a program instead.
Either. Live online for teams anywhere in Europe and the USA, with a producer running the breakout rooms and the tech. In person at your site, in Finland and the Helsinki region first and elsewhere in Europe on request, with travel at cost.
English or Finnish, as you choose. The agenda is the same in both.
Yes. Participants who attended and completed the exercise receive a certificate, recorded on the TechClass platform alongside their other training.
Workshops are priced per workshop for up to 20 participants, with a fee for each extra participant up to 30, and quoted on inquiry. In person adds travel at cost. There are no design fees.
Within a week, an impact report: attendance, feedback, what participants produced, and the agreed next step. It reports only what was measured.