Operational Resilience & Third-Party Outage Exercises

A custom scenario built around a critical vendor or cloud provider failure — testing failover decisions, recovery prioritization, and regulatory notification.

When a critical dependency fails.

Most organizations don't control their most critical dependencies. This exercise tests how your team makes failover and recovery decisions when a vendor or cloud provider can't tell you when service will return.

The capabilities this exercise is built to test.

Third-party & vendor coordination Failover decision-making Recovery time objectives Regulatory notification Customer communications Recovery prioritization Documentation & evidence Board engagement

An illustrative walkthrough — not a real incident.

11:02

Inject 01

Your primary cloud provider reports a regional outage affecting core services.

11:14

Inject 02

A critical third-party vendor confirms they cannot provide an ETA for restoration.

11:40

Inject 03

Customer-facing transactions begin failing.

12:05

Inject 04

Your team must decide whether to fail over to a backup provider with known limitations.

12:30

Inject 05

A regulator requests confirmation that critical services remain available.

13:10

Inject 06

The outage passes four hours. Recovery time objectives are now in question.

The Pressure Test

A half-day executive tabletop built on this scenario, adapted to your real critical services and dependencies. Engagements generally begin at $15,000.

Tier 1

The Pressure Test

Facilitated live, plus a decision log, an after-action report, and a board-ready summary.

Design brief · custom scenario & injects · live facilitation · decision log · after-action report · board-ready summary

For a multi-scenario program that includes an observed functional or disaster-recovery test, see The Full Break.

Common questions

Is this the same as a disaster recovery test?

It complements one — this exercise tests the decisions and coordination around an outage, and can be paired with an observed functional or DR test in The Full Break.

Do you assess our actual vendor contracts and dependencies?

The scenario is built from your real critical services and third-party dependencies, but a full vendor risk assessment is a separate, deeper engagement.

What regulatory frameworks does this align with?

The exercise is designed to align with operational resilience expectations common in financial services and other regulated industries.

Scope this exercise.

Reach out directly. All inquiries are confidential.

Location — Austin, Texas — working with organizations nationally
Confidential by design

Exercises often require access to crisis plans, escalation structures, and vulnerabilities. That material is handled in confidence, and NDAs are available on request.

Request a scoping call →