Forward Security Labs

Test Your Organization
Before the Real Emergency.

Forward Security Labs designs and facilitates customized, HSEEP-aligned tabletop exercises for hospitals, health systems, healthcare coalitions, trauma systems, EMS, public health, emergency management, and government.

Engagements range from a single facilitated exercise through multi-facility regional exercise programs. Ready-to-run packages are also available for teams that want to self-facilitate.

Regional Medical Surge Trauma System Surge Patient Distribution Mass Casualty Active Shooter Ransomware Business Continuity

Prefer to run it yourself? Explore ready-to-run exercises →

Exercises designed and facilitated by Michael Messina, a U.S. Army veteran with nearly two decades in EMS, including paramedic operations and supervisory leadership within systems involving Level I and Level II trauma centers and interfacility transfer to higher levels of care. Active Connecticut Paramedic license. B.S. in Cybersecurity.  ·  SBA Certified SDVOSB  ·  SAM.gov Registered  ·  CAGE: 1AFL4  ·  UEI: XLRANAT2ULJ9

SBA Service-Disabled Veteran-Owned Small Business certified
Flagship Engagement

Regional and Hospital Exercise Programs

A full exercise development and facilitation engagement for organizations coordinating multiple hospitals, agencies, and partners. This is consulting work, not a larger download.

Health Systems · Coalitions · Trauma Systems · Government
Regional & Hospital Program
From $20,000
Scoped to the number of participating organizations, the complexity of the scenario, the depth of evaluation, and whether delivery is virtual, hybrid, or on site. Every engagement is quoted individually after a scoping conversation.
Milestone-based payment schedules are available for grant-funded and agency budget cycles.
Discuss a Regional Exercise
Scope can include
✓Planning meetings with your exercise planning team
✓Review of client-provided plans, procedures, and annexes
✓Customized exercise objectives tied to your capabilities
✓Scenario and inject development
✓Situation Manual and facilitator materials
✓Regional exercise facilitation across participating organizations
✓Individual facility exercises where separate testing is needed
✓Structured evaluation and facility-level findings
✓Consolidated After-Action Report and Improvement Plan (AAR/IP)
✓Executive findings briefing for leadership or a governing body
✓Virtual, hybrid, or on-site delivery
✓Documentation developed consistent with applicable HSEEP principles
Healthcare and Regional Preparedness

Testing a system, not a building

A single-facility exercise tells you how one hospital performs. A regional healthcare exercise tells you what happens when several of them need the same transport resource, the same specialty bed, or the same receiving center in the same hour.

Capabilities a medical surge exercise can test
›Regional medical surge across facility tiers
›Trauma system surge and system-wide saturation
›Patient distribution across receiving facilities
›Rural and non-trauma hospital stabilization
›Interfacility transfer to higher levels of care
›Constrained receiving capacity and diversion decisions
›Competing transfer requests from multiple facilities
›EMS and transport resource limitations
›Bed availability and critical care capacity
›Operating room and specialty-resource constraints
›Blood product availability and staffing pressures
›Regional communications and notification chains
›Situational awareness across participating organizations
›Escalation, coordination, and decision authority
›Continuity of operations during healthcare disruptions

Each participating facility can receive its own findings. The program receives a consolidated AAR/IP suitable for leadership review, corrective action tracking, and reporting to a governing or funding body.

How an Engagement Works

The exercise program lifecycle

Every customized engagement follows the same five phases, scaled to the size of the program.

01
Discover
Objectives, participating organizations, plans, procedures, risks, capabilities, and operational assumptions.
02
Design
Customized scenario, injects, discussion questions, Situation Manual, facilitator materials, and evaluation framework.
03
Exercise
Professional facilitator-led delivery, virtual or on site, with breakout structure where multiple organizations participate.
04
Evaluate
Capture strengths, gaps, bottlenecks, dependencies, and corrective actions against the stated objectives.
05
Improve
After-Action Report and Improvement Plan, plus an executive findings briefing where appropriate.

Exercise documentation is developed consistent with applicable Homeland Security Exercise and Evaluation Program (HSEEP) principles. Forward Security Labs is an independent consulting firm and is not certified, accredited, or endorsed by FEMA or DHS.

Single-Organization Engagements

Not running a whole region yet?

Facilitated and custom exercises for a single hospital, agency, department, or organization.

Facilitated Exercise
From $999
We facilitate, your team participates. Built on an existing exercise package. Single organization, single session.
✓Full exercise package included
✓Live virtual facilitation via your video platform
✓Pre-exercise participant briefing
✓Real-time inject delivery and discussion management
✓Facilitated hot wash at exercise conclusion
✓Debrief summary within 5 business days
Discuss an Exercise
Custom Exercise
From $1,500 / exercise
Your scenario, your organization, your specific risks and plans. Built from scratch. Single organization.
✓Scenario built around your operations and threats
✓Injects tailored to your systems and personnel
✓Aligned to applicable regulatory and accreditation requirements
✓Situation Manual, facilitator materials, and evaluation forms
✓One round of revisions included
✓Facilitation and AAR/IP available as add-ons
Request a Custom Exercise
Ongoing Program
From $299/mo
A recurring exercise cadence for organizations with annual regulatory or accreditation testing requirements.
✓One new exercise package per quarter
✓After-action review support for each exercise
✓Annual operational resilience assessment
✓Access to the exercise library as it grows
✓Priority turnaround on custom requests
Discuss an Ongoing Program

Want to build this capability in-house and stop hiring a facilitator every time?

See the Train the Trainer Program →

Running CAD, dispatch, or station networks?

See Fire Department Cyber Readiness →
Who This Is For

Organizations that can’t afford to be unprepared

Hospital emergency preparedness exercises are required or strongly recommended under healthcare accreditation, federal preparedness programs, emergency management doctrine, cyber insurance, and business continuity requirements.

Trauma Systems
Trauma system exercises testing surge, patient distribution, transfer, and diversion across Level I through Level IV facilities.
State and Regional Health Agencies
Multi-facility regional healthcare exercise programs for trauma divisions, regional advisory councils, and preparedness offices.
Healthcare Coalitions
HSEEP-aligned coalition exercises supporting healthcare preparedness capability and coalition surge testing objectives.
Hospitals and Health Systems
Hospital tabletop exercises supporting Joint Commission emergency management standards and the CMS Emergency Preparedness Rule.
Rural and Critical Access Hospitals
Stabilization, resource limitation, and transfer-out decision making when the nearest higher level of care is hours away.
EMS Systems
Mass casualty, transport resource, and active threat response exercises aligned to NIMS and ICS.
Public Health
Response coordination, communications, and continuity exercises for public health departments and partners.
Emergency Management
Scenario-based exercises for local and regional emergency management agencies and public safety partners.
Fire Departments
Exercises alongside dedicated CAD and dispatch cyber readiness support.
Government Organizations
Continuity, cyber incident, and coordination exercises for state, county, and municipal agencies.
Healthcare Clinics
HIPAA breach, workplace violence, and operational continuity exercises for outpatient and ambulatory settings.
Business and Critical Operations
Ransomware, wire fraud, and business continuity exercises for finance teams, SaaS companies, and critical operations.
Self-Facilitated Option

Ready-to-run tabletop exercise packages

For teams that want to run an exercise themselves without engaging a facilitator. Instant download, everything included, no facilitator experience required. $499 each.

Emergency Response
Mass Casualty / Active Shooter
For hospitals, EMS agencies, schools, and emergency management teams. Tests command, triage, lockdown, reunification, and recovery.
$499
Get the MCI Package – $499 Learn More
Cyber Incident
Ransomware Attack
For hospitals, SaaS and tech companies, MSPs, and any organization dependent on critical IT. Tests detection, containment, the ransom decision, and recovery.
$499
Get the Ransomware Package – $499 Learn More
Financial Fraud
Business Email Compromise
For finance teams, healthcare administration, and leadership. Tests wire fraud detection, vendor verification, escalation, and response under real payment pressure.
$499
Get the BEC Package – $499 Learn More
Emergency Response
Hospital Evacuation
For hospitals, health systems, and long-term care facilities. Tests horizontal and vertical evacuation, patient prioritization, tracking and reunification, and re-entry.
$499
Get the Evacuation Package – $499
Cyber Incident
Hospital Cyberattack / EHR Downtime
For hospitals and health systems. Tests extended EHR downtime operations, diversion and transfer decisions, and data reconciliation after ransomware.
$499
Get the EHR Downtime Package – $499

New to tabletop exercises? Start here.

Read: What Is a Tabletop Exercise and Why Do Small Businesses Need One? →

Have questions before you start?

Read the FAQ →
Start the Conversation

Don’t find out what your gaps are
during a real incident.

Regional and hospital exercise programs start at $20,000. Custom exercises start at $1,500. Facilitated exercises start at $999. Ready-to-run packages are $499.

Questions? michael@forwardsecuritylabs.com

Forward Career Labs LLC d/b/a Forward Security Labs  ·  Wolcott, Connecticut  ·  ForwardSecurityLabs.com  ·  FAQ  ·  SBA Certified SDVOSB  ·  SAM.gov Registered  ·  CAGE: 1AFL4  ·  UEI: XLRANAT2ULJ9