By sector

A crisis has a different face depending on who suffers it

Six sectors, and for each the domains of the document corpus Lena draws on. Cyber is one of them, among others.

Nuclear

Shelves drawn on

Nuclear industry · Public warning · Evacuation · International cooperation

Nuclear operator

On-site emergency plan exercise, interface with the safety authority, public information: the sector where doctrine is densest and every move has to be right.

Accident and loss-of-function scenarios, aligned with sector doctrine
Operator unit and national crisis unit played in parallel
Communication to the authority and to the public, with its deadlines
After-action review confronted with the lessons of major industrial crises

Health

Shelves drawn on

Health and humanitarian · Health crisis actors · Victims and psychosocial care · Business continuity

Healthcare facility

Emergency plan, mass casualties, information system outage, hospital crisis unit: AP-HP is the real-world use, with its assignments, directories and role sheets in Lena's workspace.

Hospital crisis unit assembled from your role sheets
Health and cyber scenarios, including loss of the patient record
Care of victims and families, psychological support
Continuity of care and return to normal

Local authorities

Shelves drawn on

Exercises and simulation · Public warning · Evacuation and shelter · French national framework

Local authority and public warning

Municipal safeguard plan, the ANSSI exercise kit, evacuation, emergency shelter: what that shelf, already in service, contains, word for word.

Maturity reviewExample

First exercise
Third exercise

Municipal safeguard plan exercise following the civil protection handbook
ANSSI kit for local authorities: schedule, briefing, directory, data protection notification
Public warning and evacuation management
Coordination with the prefecture and emergency services

Industry

Shelves drawn on

Industrial cyber · Risk analysis · Energy and utilities · Recovery and reconstruction

Industrial site and technological hazards

Seveso, on-site accident, cyberattack on controllers: an industrial crisis mixes safety, security, environment and neighbours.

Industrial accident and industrial cyber (OT) scenarios
Site crisis unit and group crisis unit, with their interfaces
Communication to residents, authorities and the press
Risk analysis and recovery

Transport

Shelves drawn on

Transport · Evacuation and shelter · Security and terrorism · Mass gatherings

Transport operator

A major incident on a network leaves thousands of people waiting for a decision: evacuation, information, shelter, resumption.

Service interruption and accident scenarios
Stranded passengers and continuous information
Security and mass gatherings
Resumption and after-action review

Cyber

Shelves drawn on

Cyber crisis · Cyber compliance · CSIRT and SOC · Legal

Cyber crisis

Ransomware, APT, data breach: the scenario is mapped to MITRE ATT&CK, NIS2 and DORA compliance is taken into account, and the unit plays notification as well as communication.

MITRE ATT&CK mappingExample

Technique played in the scenario
Technique in the framework

Scenarios mapped to MITRE ATT&CK, with kill chain coverage
Notification to authorities and the data protection regulator within deadlines
CISO, forensics, legal and communications coordination
After-action review and maturity assessment for NIS2 and DORA requirements

Another sector?

It is probably on the bookcase. Tell Lena, she will say which shelves she would draw on.