Exercise Logistics & Participant Readiness Checklist
Confirms attendees, pre-reads, rooms, observers and ground rules are set so the exercise starts on time.
Available soon
- Format
- Excel
- Size
- 62 KB
- Length
- 10 sheets
- Version
- 1.1
- Updated
Follow this documentFree account. We can email you when it changes.
What's inside
What changed
- 1.1
DORA Article 11(6) quoted in full: the yearly test covers ICT systems supporting all functions.
- 1.0
Published.
Preview
The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.
Instructions
How to use this workbook
| Step | What to do |
|---|---|
| 1 | Open the checklist when the sponsor approves the exercise, 40 working days before it (the Exercise Planning & Facilitation Procedure). On the Summary sheet, enter the exercise ID, the exercise, its date and the start time. Every due date on the Checklist sheet then calculates. |
| 2 | Set the check date on the Summary sheet to today, or type =TODAY(). An item not done by its due date shows Overdue in the Check column. |
| 3 | Work through the items as they fall due. Record the status (Done, Open or N/A), the date it was done and the evidence: the approval email, the invitation list, the room booking. N/A needs a reason. |
| 4 | Items marked Critical are the ones without which the exercise cannot start on time or cannot test what it set out to test. Not ready: a Critical item is overdue at the check date. Ready, with actions: nothing Critical is overdue, but items are still open (not yet due, overdue but not Critical, or an entry to correct). Ready: every item is Done, or N/A with a reason. |
| 5 | Complete the checklist 5 working days before the exercise and again at the final check the day before. If the status is Not ready, the exercise lead and the sponsor decide the same day: fill the gap or move the date. Record the decision in the sign-off. |
| 6 | On the day, use the Session plan sheet: the run of show with clock times from your start time, the hot debrief and the ground rules to read out. |
| 7 | Add items of your own on the blank rows at the foot of the checklist, with an ID, a timing group from the list and the working days before the exercise (for example -10). |
| 8 | To clear the EXAMPLE, delete the contents of the 'Row' column and of every yellow column on the checklist, and the exercise details on the Summary; the items stay. |
Legend
Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.
| EXAMPLE | Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval. |
EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders. Its next tabletop, EX-2026-03, is executive payment fraud (SC-05) on 22 Oct 2026, checked as at 30 Sep 2026. Everything due by then is done; the rest is not yet due, so the status is Ready, with actions. The drill before it, EX-2026-02 on 6 Oct 2026, uses the shorter list in the drill tailoring note below.
Tailoring — small organisation: keep every Critical item. The exercise lead can also facilitate a short session, with someone else as scribe, and one observer from outside the team is enough.
Tailoring — board session: allow 90 minutes, invite the board through its secretary at least as early as the D-30 group, and send the pre-read with the board papers. The ground rules are the same.
Tailoring — drill: the drill tests one step done for real. Keep the sponsor, the objectives, the observer, the timings and the hot debrief; drop the scenario and inject items. Warn the people whose systems the drill touches.
Tailoring — remote session: every item applies. Test the dial-in with each remote participant, and send each inject to everyone at the same moment.
Checklist
The checks, by when they fall due. Yellow columns are yours; Due and Check calculate from the exercise date and the check date on the Summary sheet.
| Row | Item ID | Timing | Working days from the exercise | Item | Done when | Rule or step | Critical | Owner | Due | Status | Done on | Evidence or note | Reason (for N/A) | Check |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | LR-D40-01 | D-40: Scope and objectives | D-40 | Sponsor named and the kind of exercise chosen | An executive sponsor has asked for the exercise. The kind is set: tabletop (180 minutes), board session (90 minutes), drill (60 minutes). | EX-01 | No | Exercise lead | 27 Aug 2026 | Done | 27 Aug 2026 | Sponsor: Chief Operating Officer (executive incident lead). Tabletop, 180 minutes. | Done | |
| EXAMPLE | LR-D40-02 | D-40: Scope and objectives | D-40 | Audience chosen from the programme and due | The audience is one the programme sets for this slot, and holding it now keeps it within its interval from the audience table. | EX-02 | No | Exercise lead | 27 Aug 2026 | Done | 27 Aug 2026 | AU-02 and AU-03: AU-02 last exercised 18 Mar 2026, interval ends 18 Mar 2027; AU-03 last exercised 6 Oct 2026, interval ends 6 Apr 2027. | Done | |
| EXAMPLE | LR-D40-03 | D-40: Scope and objectives | D-40 | Scenario taken from a top risk or a recent incident | The scenario comes from the risk register or an incident, and this audience did not have it last time. | EX-05 | No | Exercise lead | 27 Aug 2026 | Done | 27 Aug 2026 | SC-05, executive payment fraud. R-02: payment fraud is outside appetite, and INC-2026-015 was a €84,000 near miss. Held before the peak season. Last time these audiences had SC-01. | Done | |
| EXAMPLE | LR-D40-04 | D-40: Scope and objectives | D-40 | Three to six objectives approved by the sponsor | Each objective names a decision, who takes it and the rule it is judged against. The sponsor approved them before the scenario was written. | EX-03, EX-04 | Yes | Exercise sponsor | 27 Aug 2026 | Done | 27 Aug 2026 | 6 objectives (O1 to O6), approved 27 Aug 2026. | Done | |
| EXAMPLE | LR-D40-05 | D-40: Scope and objectives | D-40 | Re-tests that are due are among the objectives | Every objective awaiting re-test for this audience is tested again, within [[6]] months of its action being done. | EX-11 | No | Exercise lead | 27 Aug 2026 | Done | 27 Aug 2026 | SC-01 O6 (EA-05, done 12 Jun 2026) is re-tested by SC-05 O6, "handle the reputational side", for the media holding statement (CT-09). The customer notice (CT-04) is re-tested at EX-2026-02 on 6 Oct 2026. Both parts fall within 6 months of the action being done, by 12 Dec 2026. | Done | |
| EXAMPLE | LR-D30-01 | D-30: Invitations and roles | D-30 | Date and length fixed | The date and start time avoid busy periods and allow the full 180 minutes, with the hot debrief the same day. | EX-08 | No | Exercise lead | 10 Sep 2026 | Done | 10 Sep 2026 | 22 Oct 2026, 180 minutes, before the peak season (November and December). | Done | |
| EXAMPLE | LR-D30-02 | D-30: Invitations and roles | D-30 | Invitations sent to every participant | Each role holder in the audience has the date, the length and the ground rules. Never the scenario or the injects. | EX-06 | Yes | Exercise lead | 10 Sep 2026 | Done | 10 Sep 2026 | Sent 10 Sep 2026 to the role holders of AU-02 and AU-03. | Done | |
| EXAMPLE | LR-D30-03 | D-30: Invitations and roles | D-30 | Deputies invited too | Every deputy named in the plan takes part in an exercise at least every [[24]] months. | EX-07 | No | Exercise lead | 10 Sep 2026 | Done | 10 Sep 2026 | The two deputies are invited to EX-2026-03 on 22 Oct (EA-06). | Done | |
| EXAMPLE | LR-D30-04 | D-30: Invitations and roles | D-30 | Critical suppliers with a part in the scenario invited | Each supplier the scenario relies on is invited under its contract's exercise clause (P06 CL-11). | AU-05 (P06 CL-11) | No | Exercise lead | 10 Sep 2026 | Done | 10 Sep 2026 | SUP-005 email and office software provider. | Done | |
| EXAMPLE | LR-D30-05 | D-30: Invitations and roles | D-30 | Facilitator named, who takes no decisions | The facilitator runs the session and is not a participant. If they hold a role in the plan, their deputy plays it. | EX-06 | Yes | Exercise sponsor | 10 Sep 2026 | Done | 10 Sep 2026 | Head of Information Security; their own role was played by their deputy. | Done | |
| EXAMPLE | LR-D30-06 | D-30: Invitations and roles | D-30 | At least one independent observer named | One observer or more, at least one independent of the team being tested. | EX-06 | Yes | Exercise lead | 10 Sep 2026 | Done | 10 Sep 2026 | Internal Audit Manager (independent); Credit Control Manager (Finance, outside the payment chain). | Done | |
| EXAMPLE | LR-D30-07 | D-30: Invitations and roles | D-30 | Scribe named | Someone records each decision, who took it and when. Not a participant. | EX-06 | No | Exercise lead | 10 Sep 2026 | Done | 10 Sep 2026 | Security analyst. | Done | |
| EXAMPLE | LR-D25-01 | D-25: Scenario and injects | D-25 | Scenario and injects written | Every objective has at least one inject that tests it, and every inject falls inside one of the three phases. | Inject rules | Yes | Facilitator | 17 Sep 2026 | Done | 17 Sep 2026 | 8 injects (I1 to I8) in the three phases; each of O1, O2, O3, O4, O5, O6 is tested. | Done | |
| EXAMPLE | LR-D25-02 | D-25: Scenario and injects | D-25 | Facilitator cards ready | Every inject forces at least one decision. The facilitator's card names the decision, the expected good answer and the rule it is judged against. | Inject rules | No | Facilitator | 17 Sep 2026 | Done | 17 Sep 2026 | One card per inject, from the Tabletop Scenario — Executive Payment Fraud deck. | Done | |
| EXAMPLE | LR-D25-03 | D-25: Scenario and injects | D-25 | One spare inject per phase | The facilitator may hold one spare inject per phase for a discussion that stalls. | Inject rules | No | Facilitator | 17 Sep 2026 | Done | 17 Sep 2026 | Three spares, one per phase, marked as spares. | Done | |
| EXAMPLE | LR-D15-01 | D-15: Scenario check | D-15 | Scenario checked for realism | The scenario checker, who will not take part, confirms the facts, names and times would ring true. | A03 planning | No | Scenario checker | 1 Oct 2026 | Open | Not yet due | |||
| EXAMPLE | LR-D15-02 | D-15: Scenario check | D-15 | Scenario checked against today's plan and playbook | Every expected answer on the cards matches the current plan, playbook and contacts, so participants are judged on today's rules. | EX-03 | No | Facilitator | 1 Oct 2026 | Open | Not yet due | |||
| EXAMPLE | LR-D5-01 | D-5: Pre-read and logistics | D-5 | Pre-read sent, without the injects | Participants have the plan, the playbook and the ground rules. The scenario's injects stay with the facilitator. | EX-06 | Yes | Facilitator | 15 Oct 2026 | Open | Not yet due | |||
| EXAMPLE | LR-D5-02 | D-5: Pre-read and logistics | D-5 | Attendance confirmed | Every participant, or their named deputy, has confirmed. A gap in a key role is filled or the date moved. | EX-07 | Yes | Exercise lead | 15 Oct 2026 | Open | Not yet due | |||
| EXAMPLE | LR-D5-03 | D-5: Pre-read and logistics | D-5 | Room booked for the whole session | A room for 180 minutes plus set-up, with a screen and space for observers apart from the table. | A03 planning | No | Exercise lead | 15 Oct 2026 | Open | Not yet due | |||
| EXAMPLE | LR-D5-04 | D-5: Pre-read and logistics | D-5 | Dial-in arranged for anyone remote | A tested link for anyone who cannot attend in person, and a way for them to receive injects at the same moment. | A03 planning | No | Exercise lead | 15 Oct 2026 | Open | Not yet due | |||
| EXAMPLE | LR-D5-05 | D-5: Pre-read and logistics | D-5 | Observer sheets prepared | Each observer has the objectives, what Met looks like for each, the evaluation scale and a place to note times against each objective. Participants never see this sheet (EX-06). | EX-08 | No | Facilitator | 15 Oct 2026 | Open | Not yet due | |||
| EXAMPLE | LR-D5-06 | D-5: Pre-read and logistics | D-5 | Materials ready | Injects printed or loaded in order, the run of show, the ground rules and copies of the contact list and decision rights. | A03 planning | No | Facilitator | 15 Oct 2026 | Open | Not yet due | |||
| EXAMPLE | LR-D1-01 | D-1: Final check | D-1 | Room, screen and dial-in tested | The room is set out, the screen works and the dial-in has been tried from outside. | A03 planning | No | Exercise lead | 21 Oct 2026 | Open | Not yet due | |||
| EXAMPLE | LR-D1-02 | D-1: Final check | D-1 | Observers briefed | Observers know the objectives, the scale, where to sit, and that their written notes are due within 2 working days. | EX-08 | Yes | Exercise lead | 21 Oct 2026 | Open | Not yet due | |||
| EXAMPLE | LR-D1-03 | D-1: Final check | D-1 | Timings agreed with the facilitator | The run of show fits 180 minutes and the break check is planned. | Run of show | No | Facilitator | 21 Oct 2026 | Open | Not yet due | |||
| EXAMPLE | LR-D1-04 | D-1: Final check | D-1 | Participants reminded | Start time, place, dial-in and the rule on phones. Nothing about the scenario. | EX-06 | No | Exercise lead | 21 Oct 2026 | Open | Not yet due | |||
| EXAMPLE | LR-D0-01 | Day 0: On the day, before the start | "Day 0" | Room open and set before the start | The facilitator, scribe and observers are in place [[30]] minutes before the start. | Run of show | No | Facilitator | 22 Oct 2026 | Open | Not yet due | |||
| EXAMPLE | LR-D0-02 | Day 0: On the day, before the start | "Day 0" | Pre-brief ready | The 15-minute pre-brief is ready: objectives, ground rules, roles and how the session runs. participants hear the objectives, never the injects. 7 ground rules to read out. | Run of show | Yes | Facilitator | 22 Oct 2026 | Open | Not yet due | |||
| EXAMPLE | LR-D0-03 | Day 0: On the day, before the start | "Day 0" | Scribe's decision log ready | A log with the time, the decision, who took it and the inject it answered. | EX-06 | No | Scribe | 22 Oct 2026 | Open | Not yet due | |||
| EXAMPLE | LR-D0-04 | Day 0: On the day, before the start | "Day 0" | Hot debrief set for the same day, in the room | The 30-minute hot debrief is in the run of show and nobody leaves before it. | EX-08 | Yes | Facilitator | 22 Oct 2026 | Open | Not yet due | |||
| EXAMPLE | LR-D0-05 | Day 0: On the day, before the start | "Day 0" | Next steps ready for the close | The 5-minute close gives the date of the after-action report: within 10 working days. | EX-09 | No | Exercise lead | 22 Oct 2026 | Open | Not yet due |
Session plan
Session plan
The 180-minute run of show from the Exercise Planning & Facilitation Procedure. Clock times calculate from the start time on the Summary sheet.
Run of show
| Part | Starts (minutes in) | Length (minutes) | Clock time | What happens |
|---|---|---|---|---|
| Pre-brief | 0 | 15 | Objectives, ground rules, roles and how the session runs. Participants hear the objectives, never the injects. | |
| Phase 1: first signs and the first hour | 15 | 40 | Detection, triage, declaration, first containment. | |
| Break | 55 | 10 | Facilitator and observers check timing and which objectives are still untested. | |
| Phase 2: escalation and the big decisions | 65 | 40 | Severity, reporting, decision rights, suppliers. | |
| Phase 3: recovery, reporting and communication | 105 | 40 | Restoring safely, outside communication, the days after. | |
| Hot debrief | 145 | 30 | Round the table (10 minutes). Observers (10 minutes). Agree and close (10 minutes). | |
| Close | 175 | 5 | Thanks, what happens next and when the after-action report is due. | |
| End | 180 |
Hot debrief, before anyone leaves (EX-08)
| Step | Minutes | What happens | ||
|---|---|---|---|---|
| Round the table | 10 | Each participant: one thing that worked, and one thing to change. | ||
| Observers | 10 | A first view per objective, on the evaluation scale, with the facts behind it. | ||
| Agree and close | 10 | The facilitator reads back the likely findings and the date of the after-action report. |
Ground rules to read out at the pre-brief
| No. | Ground rule | |||
|---|---|---|---|---|
| 1 | No blame. The exercise tests the plan and the organisation, never the people in the room. | |||
| 2 | Play your own role, and say what you would actually do with what you know at that moment. | |||
| 3 | Decide. "I would check the plan" is not an answer: say what the plan tells you to do. | |||
| 4 | Accept the scenario. It is realistic enough, and arguing with it uses up the time. | |||
| 5 | Findings are reported without names. What people say in the room stays there. | |||
| 6 | Phones away, unless the scenario asks you to make a call. | |||
| 7 | Anyone may stop the exercise with the stop phrase, [[Real world, stop the exercise]], if a real incident or a real emergency needs them. The facilitator ends it at once. | |||
Who does what on the day
| Role | What they do | |||
|---|---|---|---|---|
| Facilitator | The person who runs the exercise. Gives the injects, keeps time and keeps the discussion on the objectives. Takes no decisions in the scenario. | |||
| Scribe | The person who records each decision, who took it and when, as the exercise runs. | |||
| Observers | A person who watches and records against the objectives, and takes no part in the discussion or the decisions. | |||
| Participants | A person who plays their own real role in the scenario and takes the decisions that role would take. | |||
| Exercise sponsor | The executive who asks for the exercise, approves its objectives and approves the after-action report. | |||
Summary
Readiness summary and sign-off
The exercise, the check date, the results by timing group and overall, the readiness status and the sign-off. Everything below the exercise details is calculated.
| Exercise ID | EX-2026-03 | EXAMPLE. EX-year-number, as the programme numbers it. | |
| Exercise | Tabletop: Executive payment fraud | EXAMPLE. The kind of exercise and the scenario. | |
| Exercise date | 22 Oct 2026 | EXAMPLE. Every due date counts back from here in working days. | |
| Start time | [[e.g. 09:00]] | Enter a time, for example 09:00. The session plan's clock times follow. | |
| Check date | 30 Sep 2026 | EXAMPLE: the example quarter end. Use today's date, or type =TODAY(). | |
| Working days from the check date to the exercise | 16 | Calculated, Monday to Friday. Add your public holidays to the formula if you need them. | |
EXAMPLE: the example organisation's checklist for EX-2026-03, as at 2026-09-30. Clear the EXAMPLE answers to use your own.
Results by timing group
| Timing | Items | Done | N/A | Open, not yet due | Open, overdue | Critical items overdue | To correct | Status |
|---|---|---|---|---|---|---|---|---|
| D-40: Scope and objectives | 5 | 5 | 0 | 0 | 0 | 0 | 0 | Ready |
| D-30: Invitations and roles | 7 | 7 | 0 | 0 | 0 | 0 | 0 | Ready |
| D-25: Scenario and injects | 3 | 3 | 0 | 0 | 0 | 0 | 0 | Ready |
| D-15: Scenario check | 2 | 0 | 0 | 2 | 0 | 0 | 0 | Ready, with actions |
| D-5: Pre-read and logistics | 6 | 0 | 0 | 6 | 0 | 0 | 0 | Ready, with actions |
| D-1: Final check | 4 | 0 | 0 | 4 | 0 | 0 | 0 | Ready, with actions |
| Day 0: On the day, before the start | 5 | 0 | 0 | 5 | 0 | 0 | 0 | Ready, with actions |
| All items | 32 | 15 | 0 | 17 | 0 | 0 | 0 | Ready, with actions |
| Status — Not ready: a Critical item is overdue at the check date. Ready, with actions: nothing Critical is overdue, but items are still open (not yet due, overdue but not Critical, or an entry to correct). Ready: every item is Done, or N/A with a reason. To correct: Done without a date, N/A without a reason, or an item without a due date. Items without an Item ID are not counted. | ||||||||
Other counts
| Count | Items |
|---|---|
| Critical items in the checklist | 10 |
| Critical items not yet done | 5 |
| Items done after their due date | 0 |
Sign-off
| Role | Name | Date | Status at sign-off | Decision or reference | ||||
|---|---|---|---|---|---|---|---|---|
| Checked by (Exercise lead) | [[Name]] | [[YYYY-MM-DD]] | [[Status]] | [[Reference]] | ||||
| Ready to run, accepted by (Exercise sponsor) | [[Name]] | [[YYYY-MM-DD]] | [[Status]] | [[e.g. go ahead; or the gap filled; or the date moved to]] | ||||
| Final check, the day before | [[Name]] | [[YYYY-MM-DD]] | [[Status]] | [[Reference]] | ||||
After the exercise: observers' written notes within 2 working days (EX-08), and the after-action report approved within 10 (EX-09). Record both in the Exercise Observations & Improvement Tracker.
Lists
| Status | YesNo | Timing |
|---|---|---|
| Done | Yes | D-40: Scope and objectives |
| Open | No | D-30: Invitations and roles |
| N/A | D-25: Scenario and injects |
D-15: Scenario check
D-5: Pre-read and logistics
D-1: Final check
Day 0: On the day, before the start
Definitions
Definitions
| Term | Meaning in this workbook |
|---|---|
| Exercise | A planned rehearsal of the incident response plan on a made-up incident: a discussion of a scenario, a test of one part (a restore, a call tree), or a full simulation. A live incident is not an exercise. |
| Tabletop | An exercise held as a discussion. Participants sit together, receive the scenario in stages and say what they would decide and do. Nothing is switched off or restored. |
| Drill | A short exercise of one part of the plan, done for real: calling the out-of-hours numbers, isolating a site, or restoring a system from backup. |
| Objective | A decision the exercise sets out to test, written before the scenario, with who takes it and the rule it is judged against. |
| Inject | A new piece of the scenario given to participants at a set time: a fact, a message, a call or a problem. Each inject forces at least one decision. |
| Facilitator | The person who runs the exercise. Gives the injects, keeps time and keeps the discussion on the objectives. Takes no decisions in the scenario. |
| Observer | A person who watches and records against the objectives, and takes no part in the discussion or the decisions. |
| Participant | A person who plays their own real role in the scenario and takes the decisions that role would take. |
| Sponsor | The executive who asks for the exercise, approves its objectives and approves the after-action report. |
| Scribe | The person who records each decision, who took it and when, as the exercise runs. |
| Scenario checker | A subject expert who checks the scenario for realism and does not take part: [[a subject expert who does not take part, e.g. the managed IT provider's lead]]. |
| Hot debrief | A short, structured discussion held straight after the exercise, the same day, while memories are fresh. |
| After-action report | The written report of an exercise: what was tested, the result for each objective, what held, what failed and the improvement actions agreed. Approved by the sponsor. |
| Working days from the exercise | Monday to Friday, counted back from the exercise date: D-40 is 40 working days before it, Day 0 is the day itself. Public holidays are not skipped unless you add them to the WORKDAY formula. |
| Timing group | The planning step the item belongs to, from the Exercise Planning & Facilitation Procedure: D-40: Scope and objectives; D-30: Invitations and roles; D-25: Scenario and injects; D-15: Scenario check; D-5: Pre-read and logistics; D-1: Final check; Day 0: On the day, before the start. |
| Check date | The date the checklist is read at. Items due before it and not done are overdue. |
| Critical item | One without which the exercise cannot start on time or cannot test what it set out to test. One overdue makes the status Not ready. |
| Rule or step | The rule of the Tabletop Exercise Design Methodology the item serves (EX-01 to EX-12), or the part of the Exercise Planning & Facilitation Procedure it comes from: A03 planning, Run of show, or Inject rules. AU-05 is the supplier audience. |
| Readiness status | Not ready: a Critical item is overdue at the check date. Ready, with actions: nothing Critical is overdue, but items are still open (not yet due, overdue but not Critical, or an entry to correct). Ready: every item is Done, or N/A with a reason. |
| EXAMPLE | A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, its exercise EX-2026-03 on 22 Oct 2026, as at 30 Sep 2026. Clear the EXAMPLE answers before use. |
Framework References
Framework references
These references indicate relevance only and do not reproduce the text of any standard.
| Framework | Reference | Supported by |
|---|---|---|
| ISO/IEC 27001:2022 | Annex A 5.24 — Information security incident management planning and preparation | The checklist as a whole: the exercise that tests incident management is planned and prepared, with roles set |
| NIST CSF 2.0 | ID.IM-02 — “Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties” | Objectives, observers and the hot debrief set up so that the exercise yields improvements |
| NIST CSF 2.0 | GV.RR-02 — “Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced” | Invitations and roles: role holders and deputies take part and know their authorities |
| NIST CSF 2.0 | GV.SC-08 — “Relevant suppliers and other third parties are included in incident planning, response, and recovery activities” | LR-D30-04: critical suppliers invited to the exercise that involves them |
| NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 3.5.5 — “The relevant entities shall test at planned intervals their incident response procedures.” | The checklist as a whole: the incident response procedures tested at the planned interval, on time |
| DORA — Regulation (EU) 2022/2554 | Article 11(6) — test the ICT business continuity plans and the ICT response and recovery plans “in relation to ICT systems supporting all functions at least yearly, as well as in the event of any substantive changes to ICT systems supporting critical or important functions”, and test the crisis communication plans (Article 14); financial entities other than microenterprises include in the testing plans “scenarios of cyber-attacks and switchovers between the primary ICT infrastructure and the redundant capacity, backups and redundant facilities”; the policy and plans are regularly reviewed taking into account test results and recommendations from audit checks or supervisory reviews | Tailoring for financial entities: the plans tested at least yearly, with scenarios of cyber-attacks |
Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2) and Implementing Regulation (EU) 2024/2690; Regulation (EU) 2022/2554 (DORA); Regulation (EU) 2016/679 (GDPR)