Skip to training guide
CRISIS/CTRL

Guided example · 3–5 minutes

Learn the desk by using it.

Follow one access alert from first observation to debrief. Every interaction stays inside this tutorial.

01 / Role and mission

Know your desk before you act.

Your authority determines which decisions and competencies the exercise can fairly assess.

How an exercise works

A cycle of evidence and decisions

  1. 01BriefingKnow the organisation and your authority.
  2. 02New informationAlerts, messages and requests arrive over time.
  3. 03UnderstandSeparate observations from assumptions.
  4. 04InvestigateRequest evidence when the picture is incomplete.
  5. 05DecideChoose a response proportionate to what you know.
  6. 06ConsequencesOperational and technical effects may arrive later.
  7. 07AdaptRevise your assessment when evidence changes.
  8. 08DebriefReview your decisions and individual performance.
Guided example · You are

CSIRT analyst

Aegis Research Command SAS

Within your authority
  • Investigate technical evidence
  • Determine likely scope
  • Recommend containment
  • Escalate important findings
Owned by another role
  • Approve public statements
  • Decide regulatory notification

Assessment boundaryYou are evaluated primarily on actions within your authority.