How to prepare for and plan your organisation's response to severe cyber threat: a guide for CNI

2X2 scenario planning is a futures tool to support decision making when there is a high degree of uncertainty in the future, for example when implementing a significant design change to cyber security architecture. It provides a structured method to explore key uncertainties – such as threat actor capabilities and system resilience – and test the robustness of strategies under different conditions.

When you need to make decisions in an area where there is a lot of future uncertainty – such as designing a new policy, creating new security software, or an organisational change – and you need to understand how different future scenarios may impact the outcomes of a decision.

What do I need?

• A blank 2X2 scenario template, or something to draw on such as a whiteboard or paper.

There are 2 initial approaches to using the 2X2 matrix:

• Broad. Explore the different possible threats the system may face by a certain date, for example in 5 years' time.
• Specific. For example, asking “How will our organisation endure significant cyber attacks over a prolonged period?"

Identify uncertainties

• Identify key uncertainties which could have a major impact on your decision. For example, this could be the public's reception to a new technology, rate of development, or the economic climate. 
• Choose the top 2 (or 3) that represent the uncertainties that will have the greatest impact on your decision today. 

Input uncertainties into the matrix

• Draw a 2x2 matrix, or use the template, and place one uncertainty on each axis. For example, the top half of your matrix might represent a future recession, while the lower half represents economic growth. If you have chosen 3 uncertainties, your matrix will be 2x2x2, and you will have 8 boxes in total. 

Develop scenarios

• Each of the boxes of your matrix represents a possible future. Consider each one in turn and describe what good would look like in each future, noting this down in the box. Give it a descriptive name.  

Make decisions

• For each box, consider what decisions would need to be made today in order to create that desirable outcome.
• Look for 'no brainer' decisions. These are ones that are either required for all scenarios, or are only relevant for one or two scenarios, but are cheap and don't impact negatively on the other scenarios. 
• Consider whether there are any expensive decisions that are critical to one or more scenarios, and don't negatively impact on the other scenarios. Here you decide where and when you want to invest in that potential outcome.
• If there are decision conflicts between different scenarios, assess when that decision needs to be made and consider what further information is required to help with the decision.

The example 2 by 2 scenario above presents the following scenarios based on different levels of cyber attack against the energy sector and whether secure access to Operational Technology (OT) had been applied.
 
On the North to South axis:
•    Significant cyber attacks against the energy sector
•    Limited cyber attacks against the energy sector
 
On the East to West axis:
•    Not implemented secure access to OT
•    Implemented secure access to OT
 
Which is used to create the following four potential future outcomes
 
Top left box – Cyber actor able to access OT from IT stopping critical functions
Top right box – Cyber actor not able access OT from IT securing critical functions
Bottom left box – Cyber actor conducts reconnaissance and identifies how they could exploit OT. Creating potential future risk
Bottom right box – Cyber actor conducts reconnaissance but is unable to identify how they could exploit OT. Reducing future risk

• The scenarios simply provide examples of possible future outcomes. They can help illuminate and describe where you might need interventions to enable realisation of the desired future state.  
• The futures identified are just potential outcomes, and working with others will help to identify other potential outcomes.