Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

Who decides…

Who should facilitate, observe and take part in an incident exercise?

3 decision pointsThe pack behind this answer: Cyber Incident Exercises & Tabletop Scenario Library

Add to board memo

The short answer

Recommendation
The people who hold the roles in your plan take part, with their deputies, in their own roles. Give everyone else one role: a facilitator who takes no decisions, a scribe, at least one independent observer, a scenario checker who stays out, and an executive sponsor.
Reasoning
Mixing roles is how an exercise stops testing anything. A stand-in who would not hold the role in a real incident tests nothing. A facilitator who also decides steers the result, and an observer from the team being judged cannot judge it fairly. The sponsor approves the objectives before the scenario is written and approves the report afterwards, so the exercise is tied to someone who can give time to its actions.
Considerations
  • The table size of 6 to 12 participants and the 24-month limit for deputies are defaults in the CISO Times exercise pack. Your own procedure may set different ones.
  • The exercise lead can facilitate only if they are not also a participant. If they hold a role in the plan, their deputy plays it, which is practice for the deputy too.
  • A critical supplier whose service the scenario involves plays its own part. It may help write its injects, but it is never the only observer or the checker of a scenario that tests it.
  • In a small organisation one person may be exercise lead, facilitator and scribe, with an outside observer.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
StartName who does what for the exerciseStepThe sponsor asks for it and approves objectives and reportStepInvite the role holders and their deputiesDecisionDoes the scenario involve a critical supplier's service?StepInvite the supplier to play its own partDecisionWill the facilitator hold a role in the scenario?StepTheir deputy plays the role, or an outside facilitator runs itStepName a scribe and a scenario checker who do not take partDecisionIs at least one observer independent of the team being tested?OutcomeFind one, or the sponsor decides to postponeOutcomeRoles set: one person, one role, confirmed the day before

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 11 steps.

  1. Start

    Name who does what for the exercise

    Everyone in the room has one role. Mixing them is how an exercise stops testing anything: a facilitator who also decides, or an observer who belongs to the team being judged. The pack's roles are sponsor, exercise lead, facilitator, scribe, observers, scenario checker and participants.

    In the pack

  2. Step

    The sponsor asks for it and approves objectives and report

    An executive, usually the executive incident lead in the pack's example. The sponsor approves the audience, the objectives and the date before the scenario is written, opens the session if they can, and approves the after-action report and the time for its actions. The exercise lead, often the Head of Information Security, plans the exercise and drafts the report.

    In the pack

  3. Step

    Invite the role holders and their deputies

    Participants play their own real role and take the decisions that role would take. Invite the holders of the plan's roles and, separately, every deputy, starting with the deputies closest to the 24-month limit. Keep the table to 6 to 12 in the pack's default: beyond that, split the audiences or seat the extra people as observers.

    In the pack

  4. Decision

    Does the scenario involve a critical supplier's service?

    A critical supplier with a part in your plan joins an exercise that involves its service, and plays its own part under the contract. Its people take part in their own roles: where a provider runs your IT, the pack treats its staff as participants.

    In the pack

  5. Step

    Invite the supplier to play its own part

    The contract asks each such supplier to take part in your exercises. A provider may help write injects for its own service, but it is never the only observer, and never the scenario checker for a scenario that tests it.

    In the pack

  6. Decision

    Will the facilitator hold a role in the scenario?

    The facilitator gives the injects, keeps time and keeps the discussion on the objectives, and takes no decisions in the scenario. The exercise lead can facilitate, but never as a participant too. If the lead holds a role in the plan, as the Head of Information Security often does, someone else must play it.

    In the pack

  7. Step

    Their deputy plays the role, or an outside facilitator runs it

    Where the exercise lead facilitates, their deputy plays their role for the day, which is also practice for the deputy. Otherwise another facilitator, such as an outside one, runs the session. The final check the day before confirms the facilitator is free of any role.

    In the pack

  8. Step

    Name a scribe and a scenario checker who do not take part

    The scribe keeps the decision log: each decision, who took it, both clocks and any prompt, and stays out of the discussion. The scenario checker, a subject expert such as the managed IT provider's lead where the scenario does not test that provider, checks the scenario for realism before the day, keeps it to themselves and never takes part. In a small organisation the exercise lead, facilitator and scribe may be one person, with an outside observer.

    In the pack

  9. Decision

    Is at least one observer independent of the team being tested?

    Observers watch and record against the objectives and take no part in the discussion or the decisions. At least one must be independent of the team tested and able to read a decision log: internal audit, a risk manager, or a peer from another site or organisation under a confidentiality agreement. The pack suggests two observers for a table of more than eight.

    In the pack

  10. Outcome

    Find one, or the sponsor decides to postpone

    With no independent observer confirmed at the final check, the sponsor decides: postpone, or approve a named replacement. Where there is no internal audit, an outside facilitator or a peer from another firm can be the independent observer.

    In the pack

  11. Outcome

    Roles set: one person, one role, confirmed the day before

    At the final check, confirm that each role the objectives name is covered by its holder or deputy. If neither can come, drop or change the objective with the sponsor's agreement. The decision log and observers' notes record roles, never names; keep the attendance list with names separately, to show each deputy took part.

    In the pack

    See also

Practical checklist

  1. Name the sponsor, the executive who asks for the exercise and approves the objectives and the report.
  2. Invite the plan's role holders and every deputy, starting with the deputies closest to the 24-month limit.
  3. Invite each critical supplier whose service the scenario involves to play its own part.
  4. Choose a facilitator who holds no role in the scenario, or have the lead's deputy play the lead's role.
  5. Name a scribe and a scenario checker, neither of whom takes part.
  6. Confirm at least one observer independent of the team being tested.
  7. Confirm at the final check that each role the objectives name is covered by its holder or deputy.

Evidence to have ready

  • The invitations and attendance list by role, with deputies marked, kept apart from the decision log.
  • The sponsor's approval of the objectives and of the after-action report.
  • The scenario checker's comments, showing the check was done by someone who did not take part.
  • The final-check record of who facilitated, who observed, and the observer's independence.

Assumptions

  • Your incident response plan names its roles, their deputies and the critical suppliers with a part in it.
  • The table size of 6 to 12 participants and the 24-month limit for deputies are defaults in the CISO Times exercise pack. Your own procedure may set different ones.

Not covered here