2026 ASEE Annual Conference & Exposition

Cyber incidents don't just affect IT; they disrupt essential services, operations, and the people who keep organizations running. This paper presents the Cybersecurity Incident Management Exercise (CIME) framework, a scenario-based training approach developed by the Center for Cybersecurity Innovation and Outreach at Iowa State University. Unlike traditional cyber tabletop exercises that focus on technical response, CIME centers on operational continuity, empowering frontline staff, managers, and community leaders to manage through disruption and maintain mission-critical functions.

CIME is a scalable, low-pressure tabletop model designed to simulate realistic disruptions such as ransomware, power or internet outages, and data lockouts through facilitated team-based exercises. Initially developed for local government, CIME has expanded to serve K–12 education, healthcare, transit, agriculture, and manufacturing sectors. Through a partnership with (Redacted) program, we've also engaged the industrial sector. In the agriculture space, Extension educators have been trained as local facilitators to bring this experience directly to farmers.

Each exercise guides participants through a five-step incident management process designed to help employees from across functional areas collaborate quickly. The structure of the exercise emphasizes outcomes-oriented decision-making, planning based on identified priorities, and innovating and designing actions that utilize the resources at hand. A CIME also helps teams better understand the need for internal and external communication during these types of events. Exercises are intentionally structured for non-technical participants who often lack formal cybersecurity training, yet they are crucial to an organization's response and recovery. While IT staff help ground the scenarios in realistic threats, the focus of the exercise is on the individuals who keep the organization functioning during a crisis.

The train-the-trainer program equips local facilitators with a comprehensive toolkit that includes sample scenarios, facilitator run-of-show guides, role cards, note taking templates, and step-by-step player instructions. Facilitators also earn micro-credentials that recognize their community impact and support long-term sustainability of the program.

The full paper will describe the evolution and deployment of the CIME framework across (redacted state) counties, schools, farms, and businesses. It will detail the structure of a CIME event, including scenario development, role-based player engagement, five-step exercise progression, and group debriefing techniques. Sector-specific examples will demonstrate how IT input is utilized to ground the scenarios in reality, while the exercise remains focused on the broader organization. We will also discuss our facilitator training program and credentialing approach, as well as how Strategic Doing is embedded into action planning, and share lessons learned across diverse deployments.
This paper aligns with multiple ECE Division focus areas, including workforce development models, micro-credentials and stackable credentials, new teaching and learning strategies, and ECE for non-engineers.