In five live sessions from January 12 to 28, 2027, each participant builds a board-ready Cyber Resilience Playbook for their own organization. Delivered by AABGM Inc.; tuition $1,495, or $1,295 before December 18, 2026.
At a glance
| Item | Detail |
|---|---|
| Dates | January 12 to 28, 2027 (2.5 weeks) |
| Live sessions | 5 sessions, Tuesdays and Thursdays, 7:00 to 9:00 PM Eastern |
| Total live time | 10 hours, all sessions recorded |
| Weekly commitment | About 6 hours, including worksheets for your playbook |
| Format | Live online, cohort of up to 20 participants |
| Tuition | $1,495; early tuition $1,295 before December 18, 2026 |
| Certificate | Certificate of Completion from AABGM Inc. for 10 live hours (a training record, not a professional certification) |
| Prerequisites | None. No technical background required |
Who it's for
The course is written for leaders who answer for an outage. It assumes leadership responsibility, not engineering skills.
- Executives and owners: CEOs, COOs, CFOs and practice owners who decide what must keep running and what downtime costs.
- Technology and security leaders: CIOs, CISOs and IT directors who need to turn controls into a recovery capability the board understands.
- Risk, compliance and continuity leads: risk officers, compliance managers and BC/DR owners preparing for audits, regulators and insurers.
- Consultants and advisors: MSPs, vCISOs and advisors who want a structured way to run resilience reviews with clients.
Curriculum
Each session builds one section of the playbook, following the three AI-CRRQ™ dimensions: Threat Exposure, Operational Response Capability and Recovery Velocity.
| Session | Date | Focus | What you cover | Playbook section built | Before the next session |
|---|---|---|---|---|---|
| 1 | Tue, Jan 12 | Assume breach | Prevention versus resilience; naming critical services; setting how long each can be down; the rules that apply to you (SEC, NYDFS Part 500, HIPAA, NIST CSF 2.0) | Critical services and downtime tolerance | List your top 5 critical services and their owners |
| 2 | Thu, Jan 14 | Threat exposure | Where you are most exposed: crown-jewel systems, vendors and cloud services, and the AI tools teams already use | Threat and third-party exposure map | Rank your 10 most important vendors by impact if they went down |
| 3 | Tue, Jan 19 | Response capability (live tabletop) | Incident command and decision rights; a ransomware pay or no-pay decision; when to call law enforcement; what to tell staff, clients and regulators | Incident command and ransomware decision guide | Write your call tree and who decides what in the first 4 hours |
| 4 | Thu, Jan 21 | Recovery velocity | Recovery time and data loss targets; whether backups actually restore; BC/DR gaps; manual workarounds while systems are down | Recovery targets and restore test plan | Schedule one real restore test and draft your 90-day priorities |
| 5 | Thu, Jan 28 | Board-ready | Scoring your posture with the Survival Index™ as directional decision support; building the 90-day plan; presenting to a board | Survival Index™ scorecard and 90-day plan | Present your playbook to the cohort for feedback |
The Survival Index™ formula is proprietary. Participants see it in class under a confidentiality acknowledgment.
The playbook you build
You leave with a working document for your own organization, not just a certificate. Participants who cannot share details can complete every exercise on the fictional case company, Meridian Industries, and apply the method privately.
- Critical services and downtime tolerance: the services that must keep running, their owners, and the longest outage each can survive.
- Threat and third-party exposure map: crown-jewel systems, key vendors and cloud services, AI tools in use, and where a single failure stops operations.
- Incident command and ransomware decision guide: who leads, who decides, the call tree, law enforcement contacts, and message templates for staff, clients and regulators.
- Recovery targets and restore test plan: recovery time and data loss targets per service, backup restore results, and manual workarounds.
- Survival Index™ scorecard and 90-day plan: a directional score across the three AI-CRRQ™ dimensions, the top gaps, and owners and dates for the next 90 days.
The live tabletop
Session 3 is a 90-minute ransomware tabletop on Meridian Industries. Participants take roles (CEO, CIO, legal, communications, operations) and make decisions as new facts arrive.
- Detection (0 to 30 minutes): systems are encrypted and a ransom note appears. Who is told first, and who takes command?
- Containment: what is shut down, what stays up, and which critical services switch to manual work.
- Outside help: when to bring in counsel, the insurer and law enforcement, including the FBI and the U.S. Secret Service, and why a sanctions (OFAC) check comes before any payment discussion.
- Pay or no pay: the decision framework, who has the authority, and what the board must hear.
- Communications: first messages to staff, clients and regulators, and the deadlines that apply.
- Recovery and after-action: restore order, the lessons, and the changes each participant carries into their playbook.
The exercise is educational. It is not legal advice, and participants should confirm notification duties with their own counsel.
Instructor
Alim Abdul, Founder of AICRRQ Inc. and creator of the AI-CRRQ™ framework, has more than 30 years of experience leading technology, cybersecurity and disaster recovery programs in healthcare, government, finance, media and hospitality.
- Served as an AVP at two New York health systems and built disaster recovery programs.
- Has led tabletop exercises spanning cybersecurity, business continuity, crisis management and third-party risk.
- Holds the CISSP, CISM, CISA, CRISC and CCISO; EC-Council Certified Instructor.
- Former Microsoft Certified Trainer and Microsoft Certified Solutions Architect.
- Hosts The Alim Show, a series on cyber resilience.
Enrollment, certificate and policies
Enroll at masterclass.aicrrq.com or contact info@aabgm.com or +1 929 229 5703. Employers can be invoiced directly, and teams of three or more can ask about group pricing.
- Certificate: a Certificate of Completion from AABGM Inc. for 10 live hours, issued after attending or viewing all five sessions and presenting the playbook. It is a training record, not a professional certification. Participants can submit it for CPE where their certifying body accepts self-reported training.
- Confidentiality: never share passwords, patient data or details of a live incident in class. The Survival Index™ formula is shared under a confidentiality acknowledgment.
- Disclaimer: the Survival Index™ is directional decision support. It is not a prediction, guarantee, certification, audit opinion or substitute for legal or compliance advice.
Sources
- Verizon 2025 Data Breach Investigations Report: ransomware present in 44% of breaches; third-party involvement doubled to 30%.
- IBM Cost of a Data Breach Report 2025, via Infosecurity Magazine: U.S. average cost $10.2 million; 241 days on average to identify and contain a breach.
- Summary of the final NYDFS Part 500 amendments, Debevoise & Plimpton: incident response and BC/DR plans tested at least annually, including restoring from backups.
- SEC cybersecurity disclosure rules, Polsinelli: Form 8-K disclosure within four business days of determining an incident is material.
Refunds
Full refund if you cancel at least 14 days before the first session. After that, you can transfer your seat to a colleague or a future cohort. If we cancel or reschedule the cohort, you get a full refund.