A Federal Reserve workshop for community banks offers a timely management lesson for businesses outside banking: an incident plan needs to be practiced by the people expected to use it. In September 29 opening remarks, Vice Chair for Supervision Michelle W. Bowman highlighted cyber readiness, employee training and periodic testing of incident-response programs.
The two-day Community Bank Cyber Workshop includes a tabletop exercise and discussion of AI’s defensive uses and risks. Bowman described threats including ransomware, compromised business email and vendor breaches, and emphasized basics such as asset inventories, identity controls and patch management. Her remarks are directed at banks; they do not create a new general compliance requirement for every small business.
For an owner, the useful prompt is to test the decisions surrounding an outage before a real interruption forces the team to improvise. A short discussion can expose missing contacts or unclear authority without touching production systems or staging a risky technical simulation.
Choose one ordinary interruption
Start with a hypothetical problem the team can understand: the system used to access customer orders is unavailable at the start of the working day. Make clear that this is a discussion exercise, not a live incident, and avoid using real customer records in the scenario.
Ask the person who first notices the problem to describe the next step. Who receives the report? Where is that contact information kept if the usual collaboration tool is also unavailable? Who can decide whether a temporary manual process is appropriate?
The aim is to reveal dependencies. A plan that tells everyone to read a document stored inside the unavailable service has a practical gap. So does an escalation list that contains only the personal number of someone who has left the company.
Test the message as well as the system
Give the scenario a second step: a customer calls asking whether an order will arrive. Ask who can verify the facts and who is authorized to communicate them. Separate what the business knows from what it is still investigating.
A prepared holding message can explain that the team is checking an issue without inventing a restoration time or claiming that information is safe before that has been established. The exercise should also identify when specialist technical, legal or contractual advice is needed. It cannot settle those obligations through guesswork.
Include the people who actually answer phones, serve customers and coordinate deliveries. They may spot a dependency that is absent from an executive summary. Let them describe the work in their own terms before translating it into a formal procedure.
Finish with a small number of fixes
Record the gaps, assign responsibility and choose a date to check the changes. A useful result might be a corrected contact list, an agreed decision-maker or a safer way to reach essential instructions. A long list with no owner is less useful than two completed improvements.
Repeat the discussion after the changes, using a slightly different situation. The test is whether people can find and follow the arrangement, not whether they remember the previous meeting’s answers.
Bowman’s wider point about readiness rests on people and continuing practice as well as technology. For a business owner, a tabletop discussion turns that principle into a manageable task: find one weak handoff now, fix it and verify that the next person can use it.
The human side of documenting work also appears in our report on preserving maintenance knowledge with Rockwell’s AI tools.
Illustrative server equipment; no cyber incident or workshop participant is pictured. Photo: panumas nikhomkhai / Pexels.
