Gold Teaming: Crisis Exercises for Senior Leadership

What does gold teaming mean?

IT security has several “teams” named after colors. The red team attacks, the blue team defends. The gold team sits above them: it is the top leadership level that makes the big decisions in a crisis.

Gold teaming is how this level practices. A facilitator feeds in a realistic scenario step by step. Participants have to react: do we shut down systems? Do we inform the authorities? Do we pay a ransom? What do we tell customers and the press?

These exercises usually take place around a table, as a tabletop exercise. Nothing is attacked and no system is changed.

Where the term comes from

The name comes from the gold-silver-bronze command structure. Police, fire and ambulance services in the UK use it to organize incident command:

• Gold: the strategic level. It sets goals, releases resources and holds overall responsibility.
• Silver: the tactical level. It plans how the goals are reached.
• Bronze: the operational level. It carries out the work on the ground.

Applied to a cyberattack, gold is the crisis team with the executive board, silver is the leadership of IT and security, and bronze is the specialists who investigate and restore systems.

Gold teaming compared

• Red teaming: a team attacks the organization realistically and looks for ways in.
• Blue teaming: the defenders detect and stop attacks.
• Purple teaming: attackers and defenders work together to close detection gaps faster.
• Gold teaming: leadership practices decisions and communication in a crisis.

The exercises complement each other. A red team test shows how an attacker gets in. A gold teaming exercise shows what happens in the boardroom afterwards. See also red team vs. blue team.

Why organizations need gold teaming

In a serious attack, the first hours count. The technology is often not the biggest problem. More often, something else is missing:

• Clear responsibilities: who may decide to cut the network off from the internet and thereby stop production?
• Reachability: do contact lists and communication channels still work when email and phones are down?
• Reporting duties: who reports the incident in time to the data protection authority, the national authority or the insurer? Under NIS2, an early warning is due within 24 hours.
• Communication: who talks to customers, staff and the press, and with what message?
• Hard decisions: is a ransom paid? Which systems are restored first?

Answering these questions for the first time in the middle of a real crisis costs valuable time. An exercise reveals the gaps beforehand.

How a gold teaming exercise works

1. Set goals: what should be tested? For example the emergency plan, reporting channels or crisis communication.
2. Develop the scenario: a realistic case tailored to the organization, its industry and its most important systems.
3. Invite participants: executive board, IT and security leadership, legal, data protection, communications and HR.
4. Run the exercise: the facilitator feeds in new developments, such as a ransom note, a press inquiry or a production outage. The team decides under time pressure.
5. Observe: observers record who decided what and when, and where things got stuck.
6. Debrief: the findings are discussed together right afterwards.
7. Act on the results: a report records weaknesses and concrete improvements, such as changes to the incident response plan.

Typical scenarios

• Ransomware: servers and workstations are encrypted, and the attackers threaten to publish stolen data. See ransomware.
• Data breach: customer data shows up on the dark web, and the press starts asking questions.
• Attack on a supplier: a key IT provider is compromised, and it is unclear whether your own organization is affected.
• CEO fraud: a fake instruction from leadership, for example via a deepfake call, has triggered a large transfer.
• Data center outage: important systems are unavailable for days. This is where business continuity planning comes in.

Tips for a successful exercise

• Stay realistic: the scenario should fit the organization. A hospital practices differently from a machine builder.
• Involve leadership in person: sending deputies defeats the purpose. The executive board in particular has to take part.
• Allow mistakes: an exercise is not a test of individuals. Those who speak openly about uncertainty learn the most.
• Use an external facilitator: a neutral facilitator keeps up the pressure in the scenario and gives an unbiased view of the results.
• Repeat regularly: at least once a year and after major changes, such as a new executive team or a new service provider.

Conclusion

Gold teaming prepares senior leadership for an emergency. Instead of testing technology, leadership practices decisions, reporting and communication in a realistic crisis. Together with red, blue and purple teaming, this gives a complete picture: how well the organization fends off attacks, and how well it acts when one succeeds anyway.