Along with our regular crisis management simulations and testing, mandatory training modules, and monthly phishing exercises for employees, we rehearse protocols and discuss appropriate responses to hypothetical crisis scenarios.