GOVERNANCE UNDER PRESSURE OBSERVATORY™ | SCENARIO 03
Crisis Demands an Immediate Decision
Primary governance pressure: Time
Intersecting pressures: Information, Resources, Relationships, Complexity
Three clocks. One decision.
A large international nonprofit organization detects suspicious activity on a centralized technology platform supporting operations across several countries. The technology team believes the activity could indicate a developing cybersecurity incident. The nature, extent, and potential consequences remain uncertain.The Chief Information Officer recommends temporarily shutting down the affected platform to contain potential exposure. The Deputy CIO believes a more targeted response may be possible, although they cannot guarantee that it would be sufficient. The Chief Operating Officer warns that a broad shutdown could interrupt time-sensitive payments to thousands of beneficiaries in a region experiencing food insecurity. The Chief Financial Officer raises concerns about financial obligations and contractual commitments. Legal counsel advises that notification requirements may arise, depending on the facts and jurisdictions involved.The CEO must decide. The organization has an incident-response protocol, but it does not clearly assign authority for an enterprise-wide shutdown with significant programmatic consequences. The board chair asks whether the decision falls within management’s authority or requires board involvement. The chair does not want consultation to delay a necessary response. An update is expected within the hour. The roundtable will take place on 19 November 2026, after which insights will be shared following editorial review.
THREE CLOCKS ARE RUNNING
The threat clock: How quickly might the suspected incident develop?
The operational clock: How quickly could intervention harm people who depend on the organization’s services?
The governance clock: How quickly must authority, consultation, and accountability be clarified?
THE DECISION
Three possible courses of action are under consideration.
Option A — Broad containment: Temporarily shut down the platform, prioritizing protection against further exposure while accepting the possibility of substantial operational disruption.
Option B — Targeted containment: Restrict selected systems and activities, attempting to preserve critical services while accepting uncertainty about whether the response will be sufficient.
Option C — Continued operation with enhanced monitoring: Keep the platform operating temporarily while gathering additional evidence, accepting the possibility that the threat could escalate.
None of these options eliminates risk.
DECISION QUESTIONS
What information is essential before acting, and what can be learned while responding?
Who has authority to decide, and what consultation is necessary without creating harmful delay?
How should leaders weigh cybersecurity exposure against interruption to essential services?
What would make the decision defensible given what was known at the time?
WHAT WOULD YOU DO?
Choose A, B, or C. What would you need to know first? How would you involve the board chair while the response is underway?
This fictional scenario is designed for governance reflection and discussion. It does not describe a real organization or incident and is not cybersecurity, legal, or operational advice.
Governance Under Pressure Observatory™
Observe honestly. Learn collectively. Govern wisely.