NIST SP 800-53 scenario testing with simulations

iluminr simulations let teams rehearse the decisions NIST SP 800-53 cares about against severe-but-plausible scenarios, and keep a record of who decided what, and when. Run them as Microsimulations, full-scale simulations, or facilitated by our team of experts.

Simulations mapped to NIST SP 800-53

AI RiskGreen Light: AI Board GovernanceThis Microsimulation builds your awareness of director accountabilities when a company deploys AI into customer-facing operations. You will be asked to evaluate an AI deployment proposal under commercial pressure, navigate conflicting advice from executives, and test how governance, documentation and disclosure expectations apply when things go wrong. The scenario is based on real-world AI governance and D&O risk patterns faced by organizations across sectors.Cyber & DataBracing for Impact: Communications TestTest your organization's ability to send timely Emergency Notifications in response to a sophisticated, self-learning malware threat that targets critical infrastructure.AI RiskBreached: AI IP LeakRespond to a sensitive data leak involving AI-generated content, focusing on incident assessments, situational awareness, and securing communication protocols.Cyber & DataData Breach: Major LeakA massive data breach has struck some of the world’s largest organizations, including your own, leading to the potential compromise of sensitive personal information. The breach has exposed the names, phone numbers, and addresses of millions of customers, raising immediate concerns about privacy, identity theft, and the security of your data handling practices.AI RiskDeepfake Threat: Cyber AttackYour organization grapples with an AI-driven cyber-attack, where advanced deepfake technology is being used to generate highly convincing fraudulent communications. This attack triggers a governance breakdown, posing severe risks to the organization’s reputation and operational integrity. --- [EngUS] Your organization grapples with an AI-driven cyber-attack, where advanced deepfake technology is being used to generate highly convincing fraudulent communications. This attack triggers a governance breakdown, posing severe risks to the organization’s reputation and operational integrity.Cyber & DataExtortion: Ransomware InvasionAddress a widespread ransomware attack demanding cryptocurrency payments, focusing on stakeholder communication and restoring operational control.Cyber & DataInside Job: Data BreachNavigate the high-stakes initial response to a sophisticated insider threat that has compromised sensitive organizational data, testing your incident response protocols when the threat comes from within.AI RiskPoisoned: Data CorruptionAssess and mitigate the impact of a sophisticated data poisoning cyber-attack that has corrupted critical operational data and disrupted decision-making processes.Cyber & DataTrading Halt: Ransomware ChaosAddress a major ransomware attack causing a service outage, suspected to be state-sponsored, by coordinating with cybersecurity experts and effectively communicating with stakeholders.AI RiskFairplay: AI Bias in a Critical ServiceAddress the fallout from AI-driven bias in critical business services, focusing on managing stakeholder concerns and reassessing operational fairness.AI RiskDigital Deceit: Workplace ThreatA deepfake video falsely depicting the CEO making controversial remarks has been traced back to an employee's corporate laptop credentials. The video is circulating online, causing backlash, and prompting an urgent response to mitigate reputational damage and address the misuse of AI. --- Formerly titled 'Deepfake: Workplace Safety'Cyber & DataDouble Tap: Cyber AttackA major information services provider faces a cyber crisis, leading to system outages, regulatory scrutiny, and eroded client trust. Participants will manage rapid response adjustments, client communication, and rebuilding credibility under intense pressure.Cyber & DataEvolved: Adaptive MalwareA sophisticated form of malware has caused disruption across global health services, telecommunication and technology providers.AI RiskTrained: AI Bias in HiringA tech company gets shutdown over AI bias allegations, disrupting global recruitment processes.Cyber & DataVished: Customer & Regulatory ImpactsA convincing voice-phishing call gives attackers a foothold, with consequences for customers and regulators. Assess the incident, identify the critical business functions at risk, and work through your regulatory obligations.Cyber & DataWage Gap: Data Breach FalloutAddress the aftermath of a data breach revealing pay inequity, focusing on stakeholder engagement, implementing corrective measures, and restoring organizational trust.AI RiskAgent Autonomous: Customer ServiceDeveloped to explore the adoption of Agentic AI as part of a severe but plausible threat impacting a Critical Operation.AI RiskAgent Down: AI Agent FailureA forward-thinking Microsimulation that explores the potential impacts and response priorities associated with agentic AI in critical services.AI RiskAI Lies: Fact vs FictionAI-generated misinformation about your organization spreads faster than you can verify it. Separate fact from fiction, decide what to say publicly, and protect trust while the story is still moving.Cyber & DataPlan Under Pressure: Cyber IncidentA confirmed disruption is unfolding. You're drawn into the early response and asked whether a formal plan should be activated.Cyber & DataAccount Takeover: Containment & ResponseA suspected account compromise points to a data breach. Contain it, escalate it and coordinate across functions.AI RiskModel Switch: AI Service OutageAn issue affecting a foundational AI service triggers a wave of questions. Decide what matters, what doesn't and what to do next.AI RiskAI Washing: Claims Under ScrutinyYour AI claims to investors and customers come under scrutiny. Decide what you can stand behind, and what you correct.

Mapping is indicative. Confirm scope against your own obligations.

Frequently asked questions

More in Standards & frameworks