The Local Government Association runs a cyber resilience exercise used by councils across England. Evocatus was brought in to sharpen it: clearer objectives, a structure that mirrors a real cyber incident, and a way to measure whether it actually works.
Our approach
Before designing anything, we joined the client team for a live run of the exercise at Newcastle City Council. Seeing it delivered was the key to detailed problem scoping: it gave us a clear picture of the requirement and showed where the exercise could develop. Applying a systems approach to training, we set out a straightforward set of learning objectives to underpin the existing exercise, and introduced a clearer turn structure reflecting the phases of a cyber incident. We produced bespoke video content to bring real-world case studies to life and reinforce the lesson in each turn, and built an outcome-focused validation questionnaire so the exercise could keep improving.
Impact
The key to impact was specifying the requirement in detail with the client rather than rushing into content. Clear outcomes and a validation mechanism gave the exercise sharper scope and greater coherence. And it was not all under the bonnet: the high-quality bespoke films were a visible signal to local-authority audiences of the LGA’s commitment to supporting them.
What we learned
This was our first project in local government, and we learned quickly that every authority is different. An exercise designed around one or two councils will not serve the majority. Broad utility needs a relatively simple core, with additional approaches and resources available to meet each audience’s experience, confidence and willingness to play the game.
This engagement sits within our resilience and continuity work, and is a good example of testing a plan properly rather than assuming it holds.