By Ann Marie van den Hurk, Mind The Gap Advisory
Walt Disney used to leave Disneyland, cross the street, and watch.
Not to relax. To see what broke when he wasn’t there.
That is the Disney Test. And most executives have never run the organizational version of it.
Here is the question it asks. Can you leave your organization for seven days, phone in the hotel safe, and come back to find that the right decisions got made without you?
If your answer was immediate and confident, stay with me anyway.
If you hesitated, that hesitation is data.
What actually happens when you leave
Most leaders believe they have delegated. They have had the conversations. Assigned the roles. Built the org chart.
But when they actually leave, one of two things happens.
The phone starts ringing because people do not know what they are authorized to decide.
Or the phone stays quiet and the wrong decisions get made, and no one says anything until they are back.
Neither of those is governance. Both of them are risk.
The Disney Test is not really about vacation. It is a diagnostic. What gets escalated when you are away, and why? Could someone else have made that call? Was there anything written down that told them they could?
Those three questions will tell you more about your governance structure than any org chart.
The gap the org chart does not show you
The org chart shows reporting lines. It does not show where decision authority actually lives versus where it is supposed to live.
That gap is governance drift. And it starts before you ever leave the building.
Governance drift does not require a crisis to take root. It grows in the ordinary moments. The meeting where someone deferred a decision because they were not sure it was theirs to make. The incident that escalated further than it needed to because no one had documented authority to act.
The structure looks right because it has never been seriously tested. The roles exist. The reporting lines are clear. But the authority was never actually transferred. It was assumed.
And assumptions do not hold under pressure.
CIRCIA just put a clock on it
Most organizations treated governance drift as an abstract risk. Federal regulators just made it concrete.
CIRCIA’s mandatory cyber incident reporting rule requires covered critical infrastructure entities to notify within 72 hours of a covered incident. Ransom payments require notification within 24 hours. The clock starts the moment a covered incident occurs.
Most organizations are building reporting workflows. Very few are asking the harder question.
Who decides it is a reportable incident in the first place?
That decision has to happen before the 72-hour clock becomes visible on anyone’s radar. It requires someone with clear, documented authority to make a call under pressure, with incomplete information, faster than feels comfortable.
When the answers to who can declare an incident, who decides whether notification thresholds are met, and who directs vendors vary by role, response slows and risk accelerates.
That is not a compliance question. That is a governance question. And it is exactly what the Disney Test surfaces.
Governance drift is not a theoretical risk. CIRCIA just put a clock on it. The organizations that have not mapped where decision authority actually lives will find out under the worst possible conditions.
What designed authority actually looks like
Designed authority is not about adding bureaucracy. It is about making explicit what everyone assumes is already clear.
Who decides. Under what conditions. Without having to ask.
When that is not written down, it does not disappear. It gets decided in the moment, by whoever is willing to make the call, with whatever information they have.
The organizations that will navigate AI and cyber crises with their reputations and operations intact are not the ones with the most sophisticated technology. They are the ones that built their decision authority structure before the pressure arrived.
Run the Disney Test. The answer will tell you everything.
If your governance structure has never been tested
Governance Gap Map
A 90-minute structured session that surfaces where governance drift has created decision authority gaps — and what that exposure looks like before a mandate, deadline, or incident forces it into view. Written finding delivered within 48 hours.
Ann Marie van den Hurk, MSc., APR is the founder of Mind The Gap Advisory and originator of the CrisisOS5™ Framework. She advises CISOs, General Counsel, Chief Risk Officers, and boards on decision authority and executive crisis readiness for the AI era. Based in Newport, Rhode Island — serving organizations in Providence, Boston, Portsmouth, Portland, and Hartford, and across New England, nationally, and globally. mindthegapcyber.com