Workplace scenarios

The real test of this course is not the final assessment. It is what you would actually do in situations like these. Read each scenario and decide on your response before reading on.

Scenario 1: Ransomware on a Monday morning

Staff arrive to find shared drives encrypted and a ransom note on every screen. The finance system is down, customer orders cannot be processed, and nobody is sure whether the backups are affected. The managing director is on leave and unreachable.

What good looks like: the plan names a deputy with authority to act, so nobody waits hours for permission to start. IT isolates the affected systems while the incident lead works from the recovery priority list produced by the business impact analysis. Because at least one backup copy is kept offline, restoration can begin without paying the ransom, and because that backup has been test-restored before, the team has a realistic idea of how long recovery will take. A designated spokesperson gives staff and customers an honest early update rather than silence.

Scenario 2: The flooded office

A burst pipe over a weekend leaves the ground floor unusable, taking out desks, paperwork and the small on-site server room. The landlord estimates repairs will take at least six weeks.

What good looks like: because alternative working arrangements were thought through in advance, most staff simply work from home, and cloud-hosted systems mean critical work continues within a day. Anything that genuinely depended on the building was identified in the BIA, so recovery effort focuses there first. Contact details for the insurer, the landlord and key staff are held in the plan, somewhere accessible outside the building.

Scenario 3: The payment provider goes down

Mid-month, the third-party platform the organisation uses to take customer payments suffers a prolonged outage. It is entirely outside the organisation's control, and the provider's status updates are vague.

What good looks like: supplier failure was treated as its own risk category, so this scenario is already in the plan. Staff switch to the agreed fallback, whether that is a second provider, manual invoicing, or clear holding communication to customers, instead of improvising under pressure. Afterwards, the incident feeds a review of whether this dependency needs stronger contractual protection or a genuine alternative.

Scenario 4: The only person who knows

The one administrator who understands the payroll process is unexpectedly signed off sick two days before pay day. Nobody else has ever run it.

What good looks like: loss of key personnel was assessed as a realistic risk, so the payroll procedure is documented step by step and a second person has walked through it during a test, meaning pay runs on time. If that preparation had not been done, the right response afterwards is to treat the scare as a near miss and remove the single point of failure before it bites for real.