How to run a cross-functional IR tabletop when legal and execs can't all make the same calendar slot?
I own our incident response exercise calendar. The technical team shows up every time. Legal, comms and the exec sponsor show up maybe once a year if I'm lucky, because coordinating five calendars across departments for a two-hour block is its own project.
The result: we've tested our SOC's response a dozen times and tested cross-functional coordination, the part that actually determines how bad a real incident looks to customers and the board, almost never.
It's not that leadership doesn't care. It's that a live incident doesn't wait for a calendar invite to clear, so the one part of the process that most needs practice is the part we can never get everyone into the room for at the same time.
We started running some sessions on a platform where agents fill in for the roles that can't attend (legal, comms) so the exercise still happens on the SOC's schedule instead of waiting for six calendars to align. Doesn't replace having the real humans eventually, but it's gotten us from one full cross-functional exercise a year to something closer to quarterly. Has anyone found another way around the scheduling wall?