Klarr Readiness Exercises

Rehearse the incident
before it is real.

A facilitated, discussion-based readiness exercise for leadership — your scenario, your obligations, one hour, no live systems at risk. The gaps get found in a room you chose, on a day you chose.

Which laws are yours? Two-minute check →
Film 52 seconds

The two doors · the exercise · the turnReads with sound off

Inject 01 The two threats

Two ways in. Only one of them looks like an attack.

Most organisations rehearse neither. The exercise puts both on the table.

From outside

Attackers moving at AI speed

Reconnaissance that took weeks now takes hours. A scan maps your subsidiaries, finds the one mail server, and narrows — faster than any human red team ever did. The first question in the room is whether anyone would notice, and who they would tell.

The clock starts before you know it exists.

From inside

The employee who becomes the incident

No malice — just trust. A customer spreadsheet pasted into an assistant to "just summarize this". A vendor-payment change drafted fluently and approved without expanding the details. The system worked exactly as designed; nobody decided anything.

Overtrust is not a character flaw. It is an unmanaged system.

Inject 02 The exercise

One hour. Real decisions. Nothing live at risk.

A structured, discussion-based simulation for your leadership team: a senior-level scenario tailored to your sector and risk profile, with realistic simulated injects — a press inquiry, a flagged payment, a screenshot circulating — arriving while the discussion runs.

1hFacilitated session, at your premises
0Live systems touched — discussion-based, by design
1Scenario, tailored to your sector and risk profile
4EU regimes the findings are mapped against
Every exercise

Statement of Completion

A formal, audit-ready record that the exercise took place: scenario, date, participants, scope. When an auditor or authority asks whether your continuity arrangements are exercised, this is the artifact that answers.

Advanced tier

Full Report

What the room discovered, made usable:

  • Executive summary a board can read in five minutes
  • Identified gaps, each tied to its business impact
  • Practical remediation steps, in priority order
Inject 03 Why through Klarr

The exercise the law already asks you for.

Every finding is mapped to the operative obligation. NIS2 § 6 nr. 3 does not ask whether you have a continuity plan — it asks whether it is exercised. The 24-hour / 72-hour / one-month incident chain is a named control in the Klarr evidence model. A readiness exercise produces exactly the artifacts those obligations are asking about.

So the hour in the room is not a team-building event with a scary theme. It is the cheapest way to discover, in rehearsal, which of your obligations would fail in production — with each gap traced to the paragraph that makes it your problem, in the same gap analysis Klarr uses across the AI Act, NIS2, DORA and GDPR.

Delivered as a Klarr service, scoped in a short call, run at your premises.

Control 02 Incident detection & reporting AI Act Art. 73 · NIS2 §§ 12–13 · DORA Art. 17–19
Control 09 Continuity & disaster recovery — exercised NIS2 § 6 nr. 3 · DORA Art. 11–12
Control 04 Human & management oversight AI Act Art. 14, 26 · NIS2 § 7
Final inject Your move

Find the gaps in rehearsal,
not in production.

Request an exercise and we'll scope the scenario to your sector in one short call. No prices on this page for a reason: the scenario comes first.

Two-minute scope check →
Klarr is a compliance intelligence platform, not a law firm and not a notified body. Nothing on this page constitutes legal advice. Readiness exercises are facilitated simulations; output should be reviewed with qualified legal counsel before reliance in regulatory, contractual, or enforcement contexts. Cordero Management ApS accepts no liability for decisions made based solely on platform output.