Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

When do we…

When does each group of people need an incident exercise, and how often?

3 decision pointsThe pack behind this answer: Cyber Incident Exercises & Tabletop Scenario Library

Add to board memo

The short answer

Recommendation
In the pack's defaults, exercise the executive and crisis team at least every 12 months, the incident response team and technical responders every 6 months, the board or its equivalent every 24 months, and each critical supplier every 12 months.
Reasoning
Each group takes different decisions and practises them at a different rate. The people who run the first hours need practice more often than the executives they brief, and the body that would decide on a ransom should meet that decision before it meets it for real. The executive interval may not be loosened, because the incident response plan must be exercised at least once a year. Every role holder and deputy also takes part at least every 24 months.
Considerations
  • Each interval is the longest gap allowed in the CISO Times exercise pack. Your own programme may set shorter ones; the yearly exercise of the plan is the floor.
  • Count from the last exercise in which the group played its own roles. A live incident never counts and never resets the clock.
  • The body that decides on a ransom depends on how you are governed: the board, the management board in a two-tier structure, or the owners, trustees or executive management where there is no board.
  • In a small firm where the executives and the incident response team are the same people, the pack exercises them together once a year, with a drill six months later.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
StartPlan the year's exercises, group by groupStepFind each group's last exercise in its own rolesDecisionWhich group are you planning for?StepAt least every 24 months, as a board sessionStepAt least every 12 months, as a tabletopStepAt least every 6 months, as a tabletop or a drillStepEvery 12 months, in an exercise involving its serviceDecisionIs the group past its due date, or is the date not known?StepExercise it in the next quarterDecisionHas every role holder and deputy taken part within 24 months?StepInvite them to the next exercise of their groupOutcomePlace each exercise before its due date, outside busy weeks

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 12 steps.

  1. Start

    Plan the year's exercises, group by group

    The pack sets an exercise programme once a year: which groups are exercised, when, and on which scenarios. In the pack, executive management approves the programme every year and the Head of Information Security owns it. Each group has its own interval: the longest gap allowed between two of its exercises.

    In the pack

  2. Step

    Find each group's last exercise in its own roles

    An interval is met only by an exercise in which the group took part in its own roles. One exercise can serve two groups if each has objectives of its own in it. A live incident does not count and does not move any due date, though its review can change the next scenario. If you cannot find the date, treat the group as overdue.

    In the pack

  3. Decision

    Which group are you planning for?

    The pack uses five audiences, because each takes a different kind of decision and practises it at a different rate. Results are compared for each group with itself: the board and the technical responders face different decisions.

    In the pack

  4. Step

    At least every 24 months, as a board session

    Only the board, or its equivalent, decides on a ransom, and it should meet that decision before it meets it for real. The format is a 90-minute board session on the decisions only it takes, such as a ransom demand or a public statement, or the last hour of the executive exercise.

    In the pack

  5. Step

    At least every 12 months, as a tabletop

    The executive incident lead, the crisis team members and their deputies. This interval may not be loosened: the incident response plan must be exercised at least once a year. A financial entity under DORA also tests its response and recovery plans at least yearly.

    In the pack

  6. Step

    At least every 6 months, as a tabletop or a drill

    The incident response team runs the first hours and needs practice more often than the executives it briefs: once a year with the executive exercise and once on its own, or a drill. Technical responders, including the managed IT and monitoring providers, practise isolation, restores and the out-of-hours route in a technical tabletop or drill. In a small firm where the executive team and the incident response team are the same few people, the pack lets them be exercised together once a year, with a drill six months later.

    In the pack

  7. Step

    Every 12 months, in an exercise involving its service

    Each Tier 1 supplier your plan names joins an exercise that involves its service and plays its own part. The contract asks it to take part in your exercises. The pack's quarterly measure counts the named suppliers that took part in the last 12 months, out of all of them.

    In the pack

  8. Decision

    Is the group past its due date, or is the date not known?

    Add the group's interval to the date of its last exercise. That is the date by which it must be exercised again. A group whose last exercise you cannot find counts as overdue.

    In the pack

  9. Step

    Exercise it in the next quarter

    Where a group is already past its date, the pack exercises it in the next quarter. A postponement that would take a group past its interval goes to executive management, who accept the delay with a date or find another slot. A live incident in the meantime does not reset the clock.

    In the pack

  10. Decision

    Has every role holder and deputy taken part within 24 months?

    Every role holder in the plan, and every deputy, takes part in an exercise at least every 24 months in the pack's default. A deputy who has never taken part joins the next exercise of their group, even if the role holder took part last time.

    In the pack

  11. Step

    Invite them to the next exercise of their group

    Check the attendance record and invite first the deputies closest to the limit. Where the exercise lead facilitates, their deputy plays their role, which is practice for the deputy too.

    In the pack

  12. Outcome

    Place each exercise before its due date, outside busy weeks

    Pair groups where the scenario needs both: the incident response team usually joins the executive exercise, and the board can join for its last hour. Consider an extra exercise after a Severity 1 incident, a major change to the plan or a new critical supplier. Report the groups exercised within their interval to executive management every quarter.

    In the pack

Practical checklist

  1. List the five groups and who belongs to each, including deputies and the critical suppliers the plan names.
  2. Find each group's last exercise in its own roles, and treat a group with no date as overdue.
  3. Add the group's interval to that date to set its due date.
  4. Exercise any overdue group in the next quarter.
  5. Check the attendance record and invite the deputies closest to the 24-month limit.
  6. Place each exercise before its due date, pairing groups where the scenario needs both.
  7. Take any postponement past an interval to executive management for a new date or another slot.

Evidence to have ready

  • The yearly exercise programme and executive management's approval of it.
  • Each group's exercise dates against its interval.
  • The attendance list by role, with deputies marked, showing each took part within 24 months.
  • The quarterly report to executive management on groups exercised within their interval and suppliers that took part.

Assumptions

  • You have an incident response plan that names its role holders, their deputies and the critical suppliers with a part in it.
  • The intervals are the defaults in the CISO Times exercise pack, and each is the longest gap allowed. Your own programme may set shorter ones; the yearly exercise of the plan is the floor.
  • 'The board, or its equivalent' is the body that would decide on a ransom, and it depends on how you are governed: the board itself; the management board in a two-tier structure; where there is no board, the owners or trustees, as the pack puts it, or executive management. The pack does not delegate this decision to a committee.

Not covered here