• • • The ceasefire is between the US and Iran and is not a regional peace —ÌýIsrael launched its heaviest strikes yet on Lebanon within hours of the announced deal. Iran hit oil infrastructure in Kuwait, the UAE, Bahrain, and Saudi Arabia — including the East-West Pipeline, the primary route for bypassing the Strait of Hormuz. Companies planning around a return to normal should instead plan around the idea that the war has narrowed, not ended.

    • If the disruption stays within one quarter, the economic damage is painful but reversible — The Dallas Fed projects WTI oil at roughly $98 per barrel with a modest GDP hit in a short-closure scenario. The catastrophic scenario — WTI above $132 with sustained negative growth — requires the closure of the war to drag past Q2. Every week the ceasefire holds improves the odds, but Iran’s strike on the Saudi bypass pipeline complicates even the optimistic timeline.

    • Iran may have stumbled into the most lucrative chokepoint tax in modern history — At conservative estimates, transit fees charged for traversing the Strait of Hormuz could generate $40 billion to $50 billion for Iran annually, or roughly 10% to 15% of Iran’s pre-war GDP — all at near-zero operating cost. That revenue stream inverts Tehran’s incentives. Indeed, keeping the toll system in place may now be worth more than restoring free transit.

On April 7, less than two hours before a self-imposed deadline that threatened the destruction of Iran’s civilian infrastructure, President Donald J. Trump announced a two-week ceasefire in the war in Iran that began on the last day of February and continued over 38 days of sustained air strikes by the Unites States and Israel. In turn, Iran carried out retaliatory attacks across over a dozen countries and forced the effective closure of the Strait of Hormuz.

With the ceasefire, all that has paused. Yet, the question every boardroom, general counsel’s office, and procurement team is asking right now is simple: How can I plan around this?

The honest answer is, not yet — and the first 24 hours have already shown why.

A fragile, but functional peace

The ceasefire is remarkably thin, and it’s based on three operative clauses: i) the US and Israel halt strikes on Iran; ii) Iran halts retaliatory attacks on the US and Israel; and iii) Iran allows “safe passage” through the Strait of Hormuz. Everything else — from nuclear terms, sanctions, reconstruction, and the legal status of Hormuz transit — has been punted to negotiations in Islamabad beginning April 10, with Pakistan mediating.

With the ceasefire, the question every boardroom, general counsel’s office, and procurement team is asking right now is simple: “How can I plan around this?”

However, what the ceasefire covers matters less than what it doesn’t. Within hours of the announcement, Israel launched its heaviest strikes yet on Lebanon, and Iran warned it would withdraw from the ceasefire if attacks on Lebanon continue. Meanwhile, Kuwait, the UAE, and Bahrain all reported fresh Iranian missile and drone strikes targeting oil, power, and desalination infrastructure after the ceasefire was in place. Most critically, Iran struck Saudi Arabia’s East-West Pipeline, the main route by which Gulf producers have been rerouting oil to bypass the blockaded strait.

That pipeline strike should command attention in every supply chain and energy risk briefing this week because it signals how shaky the agreement is, and that Iran remains a long-term threat to vital infrastructure across the region.

For companies operating in or sourcing from the Gulf, the practical implications are immediate. This is not a ceasefire that restores pre-war operating conditions; rather it is a bilateral pause between two belligerents while the regional war continues around them. Insurance premiums, shipping risk assessments, and supply chain contingency plans should reflect that distinction until there is a meaningful shift.

What does this mean for the next two weeks?

Both sides are claiming victory — and increasingly, claiming different deals. Trump called Iran’s 10-point proposal “a workable basis on which to negotiate”; and Iran’s Supreme National Security Council called the ceasefire a “crushing defeat” for Washington. The White House now says the 10-point plan Iran is publicly circulating differs from the terms that were actually negotiated for the ceasefire. Tehran, meanwhile, says there is no deal at all if Lebanon isn’t included — a condition the US has not acknowledged. And of course, the Strait of Hormuz remains closed.

These are not the hallmarks of a stable agreement; but they may be the hallmarks of a durable one. The deal is thin enough so that each side can brief its domestic audience on a different story, and as long as neither is forced to reconcile those stories publicly, the pause holds.

And the incentives to keep talking are asymmetric but real. The US has watched gas prices surge past $4 nationally as domestic support for the war — which started at levels best described as in a hole — continued to drop even further. Goldman Sachs raised its recession probability to 30% and JPMorgan to 35%, and every day the strait stays closed pushes those numbers higher. The administration needs the global economy to exhale and needs distance itself from a war so it can focus on other priorities, including an already difficult midterm election cycle.

With the ceasefire, all that has paused. Yet, the question every boardroom, general counsel’s office, and procurement team is asking right now is simple: How can I plan around this?

Iran, for its part, wants the bombing to stop. Its conventional navy has been functionally destroyed, its air defenses are highly degraded, its nuclear facilities have sustained severe damage, and its cities, bridges, and transportation networks have been hit repeatedly. The regime survived and arguably emerged with greater domestic legitimacy than it had before the war, but the physical toll is mounting. Tehran wants the strikes to stop so it can claim victory by survival without incurring any more costs.

This mutual exhaustion is the load-bearing structure of the ceasefire. If the ceasefire holds for 72 hours (as I think it might), and if the strait begins opening to escorted traffic by Friday as Iranian officials have signaled, and if neither side finds a reason to walk away before the Islamabad talks convene, then the ceasefire will likely be extended. Not because the underlying disputes get resolved, but because the cost of resuming hostilities exceeds the cost of continuing to talk. Expect a rolling series of extensions, probably 30 to 45 days at a time, that resolve nothing while letting global markets gradually stabilize.

As we wrote earlier this month, if the disruption remains limited to roughly one quarter, the oil price shock is painful but reversible, ugly, but manageable. And every week the ceasefire holds pushes the trajectory toward the manageable scenario.

What happens after the ceasefire?

Again, if the ceasefire holds, we then have to start thinking about how this conflict resolves. Not surprisingly, this is where it gets uncomfortable.

The conventional assumption in Washington and in global markets is that the Strait of Hormuz will return to normal once the fighting stops. That assumption underestimates what Iran has built.

Iran’s parliament is working to pass a Strait of Hormuz Management Plan, codifying its claimed sovereignty over strait transit and establishing a legal framework for collecting toll fees. Media reports indicate Iran has been charging vessels between $1 million and $2 million per transit and is planning to keep charging those tolls for all ships as the strait reopens. So, at $1 million per ship, and with up to 135 transits per day, 365 days a year, that’s about $40 billion to $50 billion in annual revenue for Iran, or up to 15% of Iran’s pre-war GDP. All at an operating cost that approaches zero.

Iran didn’t enter this war planning to build the most lucrative chokepoint tax in modern history, but it may have stumbled into exactly that.

Compare that to Iran’s oil sector, which generated approximately $53 billion annually in 2022 and 2023, required massive capital investment and maintenance, and was subject to constant disruption. The toll revenue is comparable in scale, dramatically cheaper to operate, and immune to sanctions. If the final number is even a fraction of this, it’s still a massive financial shot in the arm for Iran that could become a far greater advantage than the damage to capital that the war has inflicted upon the state.

Iran didn’t enter this war planning to build the most lucrative chokepoint tax in modern history, but it may have stumbled into exactly that.

Of course, this changes the structural incentives around the Strait of Hormuz in ways most analysts haven’t fully absorbed. A permanent toll system gives Iran a revenue base to rebuild the military assets it lost, reduce its dependence on oil exports, and fund domestic investment that could blunt future protest movements. The regime’s cost-benefit calculus has inverted: Keeping the toll operational in place may now be worth more than restoring the pre-war status quo.

For the US and Israel, the only way to dismantle this arrangement is by force and the last 38 days demonstrated the limits of that approach. The US achieved air and naval superiority, destroyed Iran’s conventional military, and killed the supreme leader. None of it was enough to compel capitulation, and in fact, may not have even come close. A second campaign faces the same likely result, against a population now unified by the experience of surviving the first one.

The war didn’t just disrupt global trade. It may have permanently repriced the most important shipping lane on Earth — and left every piece of energy infrastructure in the Gulf more vulnerable than it was before the first air strike landed.

Please add your voice to ¶¶Òõ³ÉÄê’ flagship , a global study exploring how the professional landscape continues to change.Ìý

In this installment of In Practice, Rose Ors, CEO of ClientSmart, spoke to Michelle-Kim Cohn, Deputy General Counsel at Dassault Systèmes, about how the global technology company employs scenario planning and simulations to prepare the company to respond to low- and high-probability, high-impact risks.

Rose Ors: Why do you engage in scenario planning and simulations?Ìý

Michelle-Kim Cohen: These tools are extremely valuable to plan effective ways for the company to respond in an actual crisis. During the scenario analysis phase, we examine trends and other data to identify contingencies that, if they occur, will significantly impact company operations. The analysis does not identify every possible contingency — the COVID-19 pandemic is a great unforeseen example — nor precisely how the contingency will unfold. What the process does is identify plausible scenarios.

We establish written policies and procedures for each event and develop the appropriate training tools. We test the efficacy of our crisis response tools with simulations — what we call drills — in low-stress environments. Each drill is a dress rehearsal that informs us on what steps work well and what steps must be changed and refined before an actual crisis hits. These drills give us a lens into the readiness of the response team and other company personnel.

It is a given that human error will be a factor in high-stress situations. The goal is to minimize errors through regular training and practice.

Rose Ors: What are other benefits?Ìý

Michelle-Kim Cohen:ÌýAnother significant benefit is the high level of trust that the process builds among the scenario-planning team members. Most of our teams are composed of legal and a cross-section of subject-matter experts from other business units. When we come together, we leave our functional silos and don a mindset where learning from and respecting divergent viewpoints matters.

It is a given that human error will be a factor in high-stress situations. The goal is to minimize errors through regular training and practice.

Another benefit of our work on scenarios has played out in our response to the pandemic. Because of the geographies in which we operate, we plan for and practice our response to natural disasters — fires, earthquakes, extreme weather. Although we had no response plan for a health crisis, our natural disaster plans and drills allowed us to quickly pivot to a full-remote operation and again pivot to returning to the office. Our natural disaster response strategy proved invaluable, particularly our emergency communication and IT plans. Of course, the COVID-19 pandemic, unlike most natural disasters, has been a far more prolonged crisis that requires a different playbook, which continues to evolve.

Rose Ors: Can you say more about the composition of the scenario team?Ìý

Michelle-Kim Cohen: A member of our legal team always has a seat at the table. The team can also include a member from ethics and compliance, human resources, IT, communications, safety and security, and other units whose expertise is needed for each scenario. Our policies and drills aim to protect our employees’ health and safety, the privacy of our stakeholders, and our ability to support our customers.

The nature of the work requires that we understand our respective roles and responsibilities and join together as a crisis response team that can make quick decisions and act in a coordinated way within a high-stress, fast-moving environment.

Rose Ors: Let’s now talk more about the simulations and drills you conduct. What are some examples?Ìý

Michelle-Kim Cohen:ÌýIn addition to drillsÌýon what to doÌýin response to natural disasters, we conduct simulations that test our readiness to respond if the government pays us a surprise visit. This scenario is most plausible for our offices operating in the European Union but also can occur in the US. We make the exercise mirror an actual event as closely as possible.

We also conduct drills to prepare the company for geopolitical risk. In Latin America, for example, we run drills on responding to political demonstrations and other types of political events that could impact operations. Although not drills, we conduct active shooter training in North America — live classroom-type training and online exercise in all our offices.

Rose Ors: Do you debrief after each actual event or simulation?

Michelle-Kim Cohen: We do a debrief right after every incident response — actual or simulated. We call the debrief an audit, and it’s a critical step. The audit may consist of several group emails or an all-hands meeting, depending on the scenario. In either case, we assess our strengths and vulnerabilities and then take the necessary steps to improve the plans and training. In addition to these audits, we regularly evaluate our written policies and procedures. The pandemic drove home an important lesson: complacency is not an option.

Rose Ors: Where do you store the plans and processes — decision trees and the like — so that everyone who needs to access them in a high-stress scenario can access them quickly?Ìý

Michelle-Kim Cohen:ÌýYourÌýquestion came up recently during a panel I was on that was organized by the Association of Corporate Counsel. It was interesting to see so many hands go up when the moderator asked how many kept their plans in a physical binder in their office. My advice is to store the most up-to-date procedures on whatever secure company system you use, so it is available from a mobile device.

Rose Ors: How do you measure the success of each scenario response in an actual crisis?

Michelle-Kim Cohen:ÌýThe goal is not to execute everything flawlessly — that is an impossibility. The goal is to perform well enough where theÌýprincipal objective of the response is achieved. So, if the aim during a cyberattack is to protect sensitive data from being stolen, the objective is met. Objectives range from business continuity to employee safety to regulatory compliance.

In an ongoing crisis — the pandemic is an apt example — our goals evolved as the state of the pandemic evolved and ranged from the speed we transitioned to remote work to the effectiveness of our communications with employees and customers.

Rose Ors: How key is leadership-level participation during the scenario planning process?

Michelle-Kim Cohen: C-Suite support is always essential to developing a culture that emphasizes risk intelligence and response preparedness. The leadership must also signal to the workforce that preparedness is a high priority by modeling the behavior they expect.

During the recent virtual annual meeting of , I was part of a panel, that discussed how in-house counsel must ensure that their company is prepared to handle any emergency. Other panelists included Laura Stevens, Executive Vice President and General Counsel of Cengage Group; Michelle-Kim Cohen, Deputy General Counsel of Dassault Systèmes; and Sarah Gatti, Corporate Counsel at Drift.com.

Here are some of the questions discussed by the panel and panelists’ responses.

How broad should your emergency response plan be for addressing any type of emergency?

A one-size-fits-all-approach may not always be feasible for company-wide emergency response planning. When preparing or updating an emergency response plan, a company should account for reasonably foreseeable emergencies that may occur, rather than addressing every possible emergency regardless of actual likelihood. This assessment depends on various factors, including geography, the company’s industry, the company’s products and services, and the nature of the workforce and whether it includes remote employees.

Geography plays a significant role in the risk assessment process and may result in different types of risk depending on location. For example, one region may be prone to certain types of natural disasters (such as earthquakes) that are unlikely to occur in another region where the company operates. Using this example, the emergency response plan for a worksite in that region must account for the possibility of those natural disasters occurring, whereas a plan for a worksite in a different region may not.

A company should also survey its existing resources and determine whether a plan already exists for a particular emergency situation, even if the internal distribution or use of these resources was limited. Existing resources can help identify reasonably foreseeable emergencies and provide a starting point for developing more comprehensive emergency planning.

Even if a company tailors its emergency response planning, certain components may be universal regardless of the type of emergency. For example, a company may use the same communication systems for alerting its workforce of an emergency, even if the extent of notification varies by the type of emergency.

How accessible should your company’s emergency response plan be?

A company must account for whether an emergency could impede access to the emergency response plan itself. A company should have copies of the emergency response plan printed out in hard copy format and kept at the company’s offices or work sites. In addition to hard copies, a company should have the emergency response plan electronically accessible, such as a version securely stored on a shared drive. Obviously, the inability to access an emergency response plan should not create an emergency in itself. For example, if there is a foreseeable risk of an emergency rendering an office physically inaccessible (such as from civil unrest), the company should not have the emergency response plan only kept in hard copy format at that office.

A company must take the proper steps to ensure that the plan’s needs are accessible to stakeholders and the persons responsible for implementing the plan. The company should also consider whether and to what extent to share the emergency response plan with its outside counsel.

Should the emergency response plan be shared externally?

A company should carefully determine to whom it discloses its emergency response plan and, if required, how much of the plan to disclose. This issue periodically comes up when customers or vendors want to determine if a company has a plan before doing business with the company. Sometimes limited disclosure of a company’s emergency response plan may be unavoidable.

A company should hesitate to fully disclose its emergency response plan to third parties unless absolutely required. Instead, a company should consider other ways of satisfying the needs of third parties that want to confirm the existence and content of the company’s emergency response plan. For example, a company could inquire whether providing a copy of the plan’s table of contents satisfies a third party’s needs. Alternatively, a company could require a nondisclosure or confidentiality agreement before disclosing any part of its emergency response plan or limiting disclosure to answering a questionnaire about its emergency response plan.

What is in-house counsel’s role in emergency response planning?

In-house counsel plays a central role in a company’s emergency response planning. Aside from serving on the crisis management team, in-house counsel often acts as a project manager in emergency response planning. As a result, in-house counsel communicates with a company’s departments and external and internal stakeholders, such as the company’s IT and communications personnel. In-house counsel also ensures that training and assessments of the plan regularly occur. In-house counsel may need to determine if the plan is current and accurately reflects up-to-date operational practices, the company’s business, and legal requirements.

In addition, in-house counsel serves as a subject matter expert with issues related to a company’s emergency response. This includes asking “what if” questions when reviewing the plan, conducting a post-mortem response to any testing of the plan or actual emergency, determining who to notify about the company’s emergency response, and ensuring that any emergency response is legally compliant.

How should your company prepare for implementing its emergency response plan?

A key component of emergency planning involves testing and training employees on the components of the plan that are relevant to their respective roles. To test the plan, the company should perform tabletop exercises to simulate reasonably likely emergency scenarios to better ensure that key personnel know their role and can implement the plan. These exercises can also identify any necessary changes for updating the plan. For example, if key personnel are unreachable during a tabletop exercise, the company should consider updating its plan by replacing them with more accessible individuals.

The company should test its emergency response plan in real-time. This may involve testing the plan after-hours because a real-life emergency occurs at any time.